CVE-2025-1793

Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially leading to unauthorized access to data of other users depending on the usage of the llama-index library in a web application.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e	Patch
https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c	Exploit Third Party Advisory
https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:llamaindex:llamaindex:*:*:*:*:*:*:*:*

History

30 Jul 2025, 21:29

Type	Values Removed	Values Added
CPE		cpe:2.3:a:llamaindex:llamaindex::::::::
References	~~() https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e -~~	() https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e - Patch
References	~~() https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c -~~	() https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c - Exploit, Third Party Advisory
First Time		Llamaindex Llamaindex llamaindex

05 Jun 2025, 20:12

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-06-05 05:15

Updated : 2025-07-30 21:29

NVD link : CVE-2025-1793

Mitre link : CVE-2025-1793

CVE.ORG link : CVE-2025-1793

JSON object : View

Products Affected

llamaindex

llamaindex

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2025-1793", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "security@huntr.dev", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2025-06-05T05:15:23.690", "references": [{"url": "https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e", "tags": ["Patch"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c", "tags": ["Exploit", "Third Party Advisory"], "source": "security@huntr.dev"}, {"url": "https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@huntr.dev", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially leading to unauthorized access to data of other users depending on the usage of the llama-index library in a web application."}, {"lang": "es", "value": "Varias integraciones de almac\u00e9n vectorial en run-llama/llama_index (versi\u00f3n v0.12.21) presentan vulnerabilidades de inyecci\u00f3n SQL. Estas vulnerabilidades permiten a un atacante leer y escribir datos mediante SQL, lo que podr\u00eda provocar el acceso no autorizado a los datos de otros usuarios, dependiendo del uso de la librer\u00eda llama-index en una aplicaci\u00f3n web."}], "lastModified": "2025-07-30T21:29:25.527", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:llamaindex:llamaindex:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D45F701-A6AA-428C-BFA6-CA30394A0C28", "versionEndExcluding": "0.12.28", "versionStartIncluding": "0.12.21"}], "operator": "OR"}]}], "sourceIdentifier": "security@huntr.dev"}