CVE-2025-1750 SQL Injection in run-llama/llama_index
Attackers can exploit SQL injection in DuckDBVectorStore to read/write files and execute code on the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-1750?
CVE-2025-1750 is a critical SQL injection vulnerability in run-llama/llama_index, published on 2 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code execution (RCE).
Weakness: CWE-89
Which versions are affected by CVE-2025-1750?
4 open source packages ship an affected version, including llama-index-vector-stores-duckdb and llama-index. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
llama-index-vector-stores-duckdb PyPI | From 0.12.19 | 0.12.21 |
llama-index-vector-stores-duckdb PyPI | From 0.12.19 | 0.12.21 |
llama-index-vector-stores-duckdb PyPI | From 0.12.19 | 0.12.21 |
llama-index PyPI | From 0.12.19 | 0.12.21 |
Products include Llamaindex Llamaindex.
How do I fix CVE-2025-1750?
Upgrade llama-index-vector-stores-duckdb to 0.12.21 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-1750 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-1750 exists.
Other vulnerabilities in run-llama/llama_index
Sources
Also known as GHSA-6mcc-q3mg-3qg6, PYSEC-2025-245, PYSEC-2026-4242.