OS Command Injection Vulnerability in LLama-Index CLI by Run-LLama

CVE-2025-1753

What is CVE-2025-1753?

The LLama-Index CLI up to version v0.12.20 is susceptible to an OS command injection vulnerability due to improper handling of the '--files' argument. This flaw allows an attacker to manipulate the CLI arguments to inject and execute arbitrary shell commands on the host system. This exploitation can occur locally if an attacker controls the CLI arguments or remotely through a web application that invokes the LLama-Index CLI with user-controlled input. As a result, this can lead to arbitrary code execution, posing significant security risks.

References