Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2025-1750
Not yet scoredAwaiting CVSS assessment
Description
An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code execution (RCE).
run-llama/llama_index
GitHubLlamaIndex is the leading document agent and OCR platform
GitHubLlamaIndex is the leading document agent and OCR platform>= 0.12.19, < 0.12.21NVD