CVE-2025-1750
📋 TL;DR
An SQL injection vulnerability in DuckDBVectorStore's delete function allows attackers to manipulate the ref_doc_id parameter to execute arbitrary SQL commands. This can lead to reading/writing files on the server and potentially remote code execution. Users of run-llama/llama_index version v0.12.19 are affected.
💻 Affected Systems
- run-llama/llama_index
📦 What is this software?
Llamaindex by Llamaindex
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Arbitrary file read/write allowing sensitive data exposure, configuration file modification, or database manipulation.
If Mitigated
Limited impact with proper input validation and database permissions restricting file system access.
🎯 Exploit Status
Exploit details available in public bounty reports; SQL injection to file operations is well-documented.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 369a2942df2efcf6b74461c45d20a0af1fbe4ae2
Vendor Advisory: https://github.com/run-llama/llama_index/commit/369a2942df2efcf6b74461c45d20a0af1fbe4ae2
Restart Required: No
Instructions:
1. Update to the latest version of llama_index. 2. Verify the commit containing the fix is present. 3. Test the delete function with malicious inputs.
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation on ref_doc_id parameter to prevent SQL injection.
Database Permissions
allRestrict DuckDB user permissions to prevent file system access.
🧯 If You Can't Patch
- Disable or restrict access to the vulnerable delete function.
- Implement web application firewall (WAF) rules to block SQL injection patterns.
🔍 How to Verify
Check if Vulnerable:
Check if using llama_index v0.12.19 with DuckDBVectorStore delete function.Check Version:
pip show llama_index | grep VersionVerify Fix Applied:
Verify the commit 369a2942df2efcf6b74461c45d20a0af1fbe4ae2 is present in your installation.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in DuckDB logs
- File system access attempts from database process
Network Indicators:
- Unexpected outbound connections from the application server
SIEM Query:
SELECT * FROM logs WHERE message LIKE '%ref_doc_id%' AND (message LIKE '%UNION%' OR message LIKE '%SELECT%' OR message LIKE '%LOAD%')