CVE-2025-1750criticalCWE-89

CVE-2025-1750: falha crítica em run-llama/llama_index

SQL Injection in run-llama/llama_index

Publicada em

Seguir esta CVE+ Monitorar run-llama/llama index+ Monitorar llama-index

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 0.9%
An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code execution (RCE).
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
run-llama · run-llama/llama_index
CVEs relacionadas — run-llama/llama_index

No mesmo produto, das mais perigosas para as menos.

CVE-2024-3271CRITICALCommand Injection in run-llama/llama_indexEPSS 2.9%CVE-2024-4181HIGHCommand Injection in run-llama/llama_indexEPSS 2.1%CVE-2024-11958CRITICALSQL Injection in run-llama/llama_indexEPSS 1.4%CVE-2024-12909CRITICALSQL Injection to RCE in run-llama/llama_indexEPSS 1.4%CVE-2025-1753HIGHCommand Injection in LLama-Index CLI in run-llama/llama_indexEPSS 1.1%CVE-2024-3098CRITICALPrompt Injection leading to Arbitrary Code Execution in run-llama/llama_indexEPSS 1.0%