CVEs-PoC/2025/CVE-2025-1750.md

CVE-2025-1750

Description

An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code execution (RCE).

POC

Reference

No PoCs from references.

Github

• https://github.com/ARPSyndicate/cve-scores
• https://github.com/Threekiii/CVE
• https://github.com/a1batr0ssG/VulhubExpand
• https://github.com/tanjiti/sec_profile
• https://github.com/zxarj/wxvl