by Kastro
Paper/Archive/CVE-2025-1793

CVE-2025-1793

run-llama run-llama/llama_index — SQL Injection in run-llama/llama_index

EPSS 0.7%public exploitCVSS 9.8
critical.is priorityof 100
50
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 51.7.517 × 2010.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially leading to unauthorized access to data of other users depending on the usage of the llama-index library in a web application.

Affected

ProductAffectedFixed inSource
run-llama/llama_indexunspecified – < 0.12.280.12.28CNA

Scores by source

@huntr_ai (CNA)9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploithuntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183crefgithub.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e