CVE: CVE-2025-1793
Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially leading to unauthorized access to data of other users depending on the usage of the llama-index library in a web application.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2025-1793 |
Exploitation
To exploit the SQL injection vulnerabilities in the affected version of the llama_index library, an attacker can craft malicious SQL queries that are executed by the application. This can be done by manipulating input fields that interact with the database, allowing unauthorized access to sensitive data or the ability to modify existing data.
Affected Products
- run-llama/llama_index v0.12.21: This version contains multiple SQL injection vulnerabilities that can be exploited to gain unauthorized access to user data.
Mitigation
To mitigate these vulnerabilities, it is recommended to update to a patched version of the llama_index library that addresses the SQL injection issues. Additionally, implementing input validation and using parameterized queries can help prevent SQL injection attacks.
References