Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2025-1750: LlamaIndex DuckDBVectorStore lets attackers read/write files
CVE-2025-1750 · published 1 day ago
Summary
The DuckDBVectorStore component used by LlamaIndex can be tricked into executing unintended commands when a specially crafted reference ID is supplied. This could let an attacker read or modify any file on the server and potentially run their own code. Apply the latest update or patch that sanitizes the input, and restrict access to the component until it is fixed.
What to do
- Update llama-index-vector-stores-duckdb to version 0.12.21.
- Update llama-index to version 0.12.21.
- Update llamaindex llamaindex to version 0.12.21 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | llamaindex | llamaindex |
>= 0.12.19, < 0.12.21 cpe:2.3:a:llamaindex:llamaindex:*:*:*:*:*:*:*:* |
| pip | – | llama-index-vector-stores-duckdb |
>= 0.12.19, < 0.12.21 Fix: upgrade to 0.12.21
|
| PyPI | – | llama-index |
>= 0.12.19, < 0.12.21 Fix: upgrade to 0.12.21
|
Original advisory text
LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id
An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code execution (RCE).
References
- https://huntr.com/bounties/e1302233-9180-4269-9047-1526247d2cd8 URL
- https://github.com/run-llama/llama_index/commit/369a2942df2efcf6b74461c45d20a0af... URL
- https://github.com/run-llama/llama_index Product
- https://pypi.org/project/llama-index-vector-stores-duckdb Product
- https://nvd.nist.gov/vuln/detail/CVE-2025-1750 Vendor Advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/llama-index/PYSEC-2025... URL
- https://github.com/run-llama/llama_index/releases/tag/v0.12.21 URL
- https://github.com/advisories/GHSA-6mcc-q3mg-3qg6 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1750.j... Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-89SQL Injection
Timeline
Published15 Oct 2026
Updated15 Oct 2026
First seen7 Mar 2026
Sources
CVE-2025-1750 · NVD
GHSA-6mcc-q3mg-3qg6 · GHSA
PYSEC-2025-245 · OSV
CVE-2025-1750 · OSV
PYSEC-2026-4242 · OSV
Track software like this
Free during beta