CVE-2025-1793

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-1793
Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially leading to unauthorized access to data of other users depending on the usage of the llama-index library in a web application.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e Patch
https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c Exploit Third Party Advisory
https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:llamaindex:llamaindex:*:*:*:*:*:*:*:*
History

30 Jul 2025, 21:29

Type Values Removed Values Added
References () https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e - () https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e - Patch
References () https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c - () https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c - Exploit, Third Party Advisory
CPE cpe:2.3:a:llamaindex:llamaindex:*:*:*:*:*:*:*:*
First Time Llamaindex llamaindex
Llamaindex

05 Jun 2025, 14:15

Type Values Removed Values Added
Summary
  • (es) Varias integraciones de almacén vectorial en run-llama/llama_index (versión v0.12.21) presentan vulnerabilidades de inyección SQL. Estas vulnerabilidades permiten a un atacante leer y escribir datos mediante SQL, lo que podría provocar el acceso no autorizado a los datos de otros usuarios, dependiendo del uso de la librería llama-index en una aplicación web.
References () https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c - () https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c -

05 Jun 2025, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-05 05:15

Updated : 2025-07-30 21:29

NVD link : CVE-2025-1793

Mitre link : CVE-2025-1793

CVE.ORG link : CVE-2025-1793

JSON object : View

Products Affected

llamaindex

  • llamaindex
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')