Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially leading to unauthorized access to data of other users depending on the usage of the llama-index library in a web application.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e | Patch |
| https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c | Exploit Third Party Advisory |
| https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c | Exploit Third Party Advisory |
Configurations
History
30 Jul 2025, 21:29
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:llamaindex:llamaindex:*:*:*:*:*:*:*:* | |
| First Time |
Llamaindex llamaindex
Llamaindex |
|
| References | () https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e - Patch | |
| References | () https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c - Exploit, Third Party Advisory |
05 Jun 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
05 Jun 2025, 05:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-06-05 05:15
Updated : 2025-07-30 21:29
NVD link : CVE-2025-1793
Mitre link : CVE-2025-1793
JSON object : View
Products Affected
llamaindex
- llamaindex
CWE
No CWE.