Vulnerability PYSEC-2025-245
Critical
CRITICAL RISK
CVSS Score: 9.8
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
1 year ago
June 02, 2025 at 10:15 AM UTC
No summary available
0.12.19 - 0.12.20
0.12.19 - 0.12.20
Details
An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code execution (RCE).
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
3 months ago
LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class
0.4.4 - 0.12.40 PYSEC-2026-2606
0.4.4 - 0.12.40 PYSEC-2026-2606
High Risk
3 months ago
llama-index has Insecure Temporary File
0.4.4 - 0.12.52 PYSEC-2026-1556
0.4.4 - 0.12.52 PYSEC-2026-1556
High Risk
3 months ago
LlamaIndex Vulnerable to Denial of Service (DoS)
0.12.15 - 0.12.20 PYSEC-2026-1554
0.12.15 - 0.12.20 PYSEC-2026-1554
High Risk
3 months ago
LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions
0.4.4 - 0.12.2 PYSEC-2026-1555
0.4.4 - 0.12.2 PYSEC-2026-1555
Critical
3 months ago
llama_index vulnerable to SQL Injection
0.4.4 - 0.12.27 PYSEC-2026-394
0.4.4 - 0.12.27 PYSEC-2026-394
Impacted packages
Timeline
Published
1 year ago
June 02, 2025 at 10:15 AM UTC
Fixed (0.12.21)
1 year ago
February 28, 2025 at 12:18 AM UTC
Last Modified
3 days ago
October 15, 2026 at 02:56 PM UTC