CVE-2025-1793
BaseFortify
Publication date: 2025-06-05
Last updated on: 2025-07-30
Assigner: huntr.dev
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| llamaindex | llamaindex | From 0.12.21 (inc) to 0.12.28 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-1793 is a set of SQL injection vulnerabilities found in multiple vector store integrations of the run-llama/llama_index library version v0.12.21. These vulnerabilities allow attackers to execute malicious SQL commands, which can lead to unauthorized reading and writing of data. This means an attacker could potentially access or manipulate data belonging to other users if the llama-index library is used in a web application. [1]
How can this vulnerability impact me? :
This vulnerability can have a severe impact by allowing attackers to gain unauthorized access to sensitive data, modify or delete data, and potentially compromise the integrity and availability of the application using the llama-index library. Given the high CVSS score of 9.8, it indicates critical risk with no required privileges or user interaction, making it highly exploitable remotely. [1]
What immediate steps should I take to mitigate this vulnerability?
To mitigate the SQL injection vulnerabilities in run-llama/llama_index version v0.12.21, immediately upgrade to version 0.12.28 or later, where these vulnerabilities have been patched across multiple vector store integrations. This update also includes fixes for related security issues such as path traversal attacks. Applying this update will help prevent unauthorized data access and improve overall security. [1]