CVE-2025-1750
An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code execution (RCE).
Vendor
Product
CWE
Yayın Tarihi
2025-06-02 10:15:20
Güncelleme
2025-07-31 16:08:49
Source Identifier
security@huntr.dev
KEV Date Added
-