CVE-2025-1750

critical · 9.8

An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code execution (RCE).

9.8

CVSS

0.8%

EPSS (exploit prob.)

56th

EPSS percentile

2025-06-02

Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
llamaindex	llamaindex	>= 0.12.19, < 0.12.21

Check a specific version with /api/v1/cve/match.

References

https://github.com/run-llama/llama_index/commit/369a2942df2efcf6b74461c45d20a0af1fbe4ae2
https://huntr.com/bounties/e1302233-9180-4269-9047-1526247d2cd8

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-1750