CVE-2025-1750: Llamaindex DuckDBVectorStore SQLi Vulnerability

CVE-2025-1750 Overview

An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code execution (RCE). The vulnerability stems from improper input sanitization in SQL queries within the DuckDB vector store integration, a critical component used in AI/LLM applications for vector similarity search.

Critical Impact

Attackers can exploit this SQL injection flaw to read sensitive files, write arbitrary data to the server, and potentially achieve remote code execution through file system manipulation.

Affected Products

• LlamaIndex version v0.12.19
• llama-index-vector-stores-duckdb integration package
• Applications using DuckDBVectorStore with user-controlled ref_doc_id inputs

Discovery Timeline

• 2025-06-02 - CVE CVE-2025-1750 published to NVD
• 2025-07-31 - Last updated in NVD database

Technical Details for CVE-2025-1750

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) resides in the delete function of the DuckDBVectorStore class within the LlamaIndex framework. The vulnerability occurs because user-supplied input through the ref_doc_id parameter is directly interpolated into SQL queries without proper sanitization or parameterization.

DuckDB, being an embedded analytical database, provides powerful file I/O capabilities that can be abused when SQL injection is possible. An attacker exploiting this vulnerability can leverage DuckDB's native functions to read arbitrary files from the server's file system and write malicious content to accessible directories. This capability chain transforms a SQL injection into a potential remote code execution scenario, particularly dangerous in server environments where the application has elevated file system permissions.

Root Cause

The root cause of this vulnerability is the direct string interpolation of the ref_doc_id parameter into SQL DELETE statements without using parameterized queries or proper input escaping. The vulnerable code path allows untrusted user input to modify the structure and intent of the SQL query being executed against the DuckDB database, breaking the boundary between code and data.

Attack Vector

This vulnerability is exploitable over the network without authentication or user interaction. An attacker can craft malicious ref_doc_id values containing SQL injection payloads that escape the intended query context. By leveraging DuckDB's file handling functions (such as read_csv, COPY TO, or similar), the attacker can:

1. Extract sensitive configuration files, credentials, or application data
2. Write malicious content to web-accessible directories or configuration files
3. Chain file write capabilities with other server-side functionality to achieve code execution

The patch addresses this by escaping parameters in SQL queries within the DuckDB vector store, as shown in the security fix:

 disallow_untyped_defs = true
 exclude = ["_static", "build", "examples", "notebooks", "venv"]
 ignore_missing_imports = true
-python_version = "3.8"
+python_version = "3.9"

[tool.poetry]
authors = ["Adithya Krishnan <me@krishadi.com>"]

Source: GitHub Commit Reference

Detection Methods for CVE-2025-1750

Indicators of Compromise

• Unusual SQL query patterns in application logs containing file path references or DuckDB file functions
• Unexpected file read/write operations originating from the LlamaIndex application process
• Web server logs showing ref_doc_id parameters with SQL metacharacters such as single quotes, semicolons, or UNION keywords
• New or modified files in application directories that were not created through normal operations

Detection Strategies

• Implement application-layer SQL injection detection rules that monitor for injection patterns in vector store operations
• Deploy Web Application Firewall (WAF) rules to block requests containing SQL injection signatures in API parameters
• Enable detailed query logging in DuckDB to capture and analyze all executed SQL statements for anomalous patterns
• Monitor file system access from the LlamaIndex application process for unexpected file operations

Monitoring Recommendations

• Configure alerting for any file I/O operations performed by the DuckDB process outside of expected data directories
• Establish baseline behavior for the delete function and alert on deviations in query structure or execution time
• Implement log aggregation to correlate suspicious API requests with downstream database and file system activity
• Deploy runtime application self-protection (RASP) to detect and block SQL injection attempts in real-time

How to Mitigate CVE-2025-1750

Immediate Actions Required

• Upgrade LlamaIndex to a patched version that includes commit 369a2942df2efcf6b74461c45d20a0af1fbe4ae2
• Audit all code paths that pass user input to DuckDBVectorStore.delete() and implement input validation
• Review application logs for evidence of exploitation attempts or successful attacks
• Restrict file system permissions for the application process to limit potential damage from file write attacks

Patch Information

The LlamaIndex maintainers have released a security fix that properly escapes parameters in SQL queries within the DuckDB vector store integration. The fix is available in commit 369a2942df2efcf6b74461c45d20a0af1fbe4ae2. Organizations should update their llama-index-vector-stores-duckdb package to the latest version containing this fix. Additional details about the vulnerability can be found in the Huntr Bounty Details.

Workarounds

• Implement strict input validation on the ref_doc_id parameter to allow only alphanumeric characters and expected delimiters
• Deploy a reverse proxy or WAF that sanitizes incoming requests before they reach the LlamaIndex application
• Run the application in a sandboxed environment with minimal file system access permissions
• Consider disabling the delete functionality temporarily if it is not critical to operations until patching is complete

# Example: Update llama-index-vector-stores-duckdb to the latest patched version
pip install --upgrade llama-index-vector-stores-duckdb

# Verify the installed version contains the security fix
pip show llama-index-vector-stores-duckdb