CVE-2025-1750: Llamaindex DuckDBVectorStore SQLi Vulnerability

CVE-2025-1750 Overview

An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code execution (RCE). The vulnerability stems from improper input sanitization in SQL queries within the DuckDB vector store integration, a critical component used in AI/LLM applications for vector similarity search.

Critical Impact
Attackers can exploit this SQL injection flaw to read sensitive files, write arbitrary data to the server, and potentially achieve remote code execution through file system manipulation.

Affected Products

LlamaIndex version v0.12.19
llama-index-vector-stores-duckdb integration package
Applications using DuckDBVectorStore with user-controlled ref_doc_id inputs

Discovery Timeline

2025-06-02 - CVE CVE-2025-1750 published to NVD
2025-07-31 - Last updated in NVD database

Technical Details for CVE-2025-1750

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) resides in the delete function of the DuckDBVectorStore class within the LlamaIndex framework. The vulnerability occurs because user-supplied input through the ref_doc_id parameter is directly interpolated into SQL queries without proper sanitization or parameterization.

DuckDB, being an embedded analytical database, provides powerful file I/O capabilities that can be abused when SQL injection is possible. An attacker exploiting this vulnerability can leverage DuckDB's native functions to read arbitrary files from the server's file system and write malicious content to accessible directories. This capability chain transforms a SQL injection into a potential remote code execution scenario, particularly dangerous in server environments where the application has elevated file system permissions.

Root Cause

The root cause of this vulnerability is the direct string interpolation of the ref_doc_id parameter into SQL DELETE statements without using parameterized queries or proper input escaping. The vulnerable code path allows untrusted user input to modify the structure and intent of the SQL query being executed against the DuckDB database, breaking the boundary between code and data.

Attack Vector

This vulnerability is exploitable over the network without authentication or user interaction. An attacker can craft malicious ref_doc_id values containing SQL injection payloads that escape the intended query context. By leveraging DuckDB's file handling functions (such as read_csv, COPY TO, or similar), the attacker can:

Extract sensitive configuration files, credentials, or application data
Write malicious content to web-accessible directories or configuration files
Chain file write capabilities with other server-side functionality to achieve code execution

The patch addresses this by escaping parameters in SQL queries within the DuckDB vector store, as shown in the security fix:

text

 disallow_untyped_defs = true
 exclude = ["_static", "build", "examples", "notebooks", "venv"]
 ignore_missing_imports = true
-python_version = "3.8"
+python_version = "3.9"

[tool.poetry]
authors = ["Adithya Krishnan <me@krishadi.com>"]

Source: GitHub Commit Reference

Detection Methods for CVE-2025-1750

Indicators of Compromise

Unusual SQL query patterns in application logs containing file path references or DuckDB file functions
Unexpected file read/write operations originating from the LlamaIndex application process
Web server logs showing ref_doc_id parameters with SQL metacharacters such as single quotes, semicolons, or UNION keywords
New or modified files in application directories that were not created through normal operations

Detection Strategies

Implement application-layer SQL injection detection rules that monitor for injection patterns in vector store operations
Deploy Web Application Firewall (WAF) rules to block requests containing SQL injection signatures in API parameters
Enable detailed query logging in DuckDB to capture and analyze all executed SQL statements for anomalous patterns
Monitor file system access from the LlamaIndex application process for unexpected file operations

Monitoring Recommendations

Configure alerting for any file I/O operations performed by the DuckDB process outside of expected data directories
Establish baseline behavior for the delete function and alert on deviations in query structure or execution time
Implement log aggregation to correlate suspicious API requests with downstream database and file system activity
Deploy runtime application self-protection (RASP) to detect and block SQL injection attempts in real-time

How to Mitigate CVE-2025-1750

Immediate Actions Required

Upgrade LlamaIndex to a patched version that includes commit 369a2942df2efcf6b74461c45d20a0af1fbe4ae2
Audit all code paths that pass user input to DuckDBVectorStore.delete() and implement input validation
Review application logs for evidence of exploitation attempts or successful attacks
Restrict file system permissions for the application process to limit potential damage from file write attacks

Patch Information

The LlamaIndex maintainers have released a security fix that properly escapes parameters in SQL queries within the DuckDB vector store integration. The fix is available in commit 369a2942df2efcf6b74461c45d20a0af1fbe4ae2. Organizations should update their llama-index-vector-stores-duckdb package to the latest version containing this fix. Additional details about the vulnerability can be found in the Huntr Bounty Details.

Workarounds

Implement strict input validation on the ref_doc_id parameter to allow only alphanumeric characters and expected delimiters
Deploy a reverse proxy or WAF that sanitizes incoming requests before they reach the LlamaIndex application
Run the application in a sandboxed environment with minimal file system access permissions
Consider disabling the delete functionality temporarily if it is not critical to operations until patching is complete

bash

# Example: Update llama-index-vector-stores-duckdb to the latest patched version
pip install --upgrade llama-index-vector-stores-duckdb

# Verify the installed version contains the security fix
pip show llama-index-vector-stores-duckdb