Vulnerability Description
Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially leading to unauthorized access to data of other users depending on the usage of the llama-index library in a web application.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Llamaindex | Llamaindex | >= 0.12.21, < 0.12.28 |
Related Weaknesses (CWE)
References
- https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bPatch
- https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183cExploitThird Party Advisory
- https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183cExploitThird Party Advisory
FAQ
What is CVE-2025-1793?
CVE-2025-1793 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially l...
How severe is CVE-2025-1793?
CVE-2025-1793 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-1793?
Check the references section above for vendor advisories and patch information. Affected products include: Llamaindex Llamaindex.