LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id

GHSA-6mcc-q3mg-3qg6 · CVE-2025-1750 · PYSEC-2025-245 · PYSEC-2026-4242 · 갱신 2026. 10. 15.

해야 할 일

llama-index-vector-stores-duckdb: 0.12.21 이상으로 올리세요.

영향 받는 패키지

생태계	패키지	수정 버전
PyPI	llama-index-vector-stores-duckdb	0.12.21

원문

LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id

An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code execution (RCE).

출처

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-1750
WEBhttps://github.com/run-llama/llama_index/commit/369a2942df2efcf6b74461c45d20a0af1fbe4ae2
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/llama-index/PYSEC-2025-245.yaml
PACKAGEhttps://github.com/run-llama/llama_index
WEBhttps://github.com/run-llama/llama_index/releases/tag/v0.12.21
WEBhttps://huntr.com/bounties/e1302233-9180-4269-9047-1526247d2cd8

오늘 목록으로

LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id (GHSA-6mcc-q3mg-3qg6) · Sieve