SQL Injection Vulnerability in DuckDBVectorStore by run-llama
CVE-2025-1750

9.8CRITICAL

Key Information:

Vendor

Run-llama

Status
Run-llama/llama Index
Vendor
CVE Published:
2 June 2025

What is CVE-2025-1750?

An SQL injection vulnerability exists in the delete function of DuckDBVectorStore within the Llama Index product, version v0.12.19. This flaw allows an attacker to exploit the ref_doc_id parameter, granting them the ability to manipulate server-side files. Such manipulation could lead to unauthorized reading and writing of files on the server, which poses significant risks, including the potential for remote code execution.

Affected Version(s)

run-llama/llama_index < 0.3.1

References

https://huntr.com/bounties/e1302233-9180-4269-9047-152624...
https://github.com/run-llama/llama_index/commit/369a2942d...

CVSS V3.0

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-1750 : SQL Injection Vulnerability in DuckDBVectorStore by run-llama