LlamaIndex DuckDBVectorStore has an SQL injection vulnerability due to ref_doc_id
LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id
AI summary
The DuckDBVectorStore delete function in run-llama/llama_index v0.12.19 has an SQL injection vulnerability. An attacker can read and write arbitrary files on the server by manipulating the ref_doc_id parameter, and it may lead to remote code execution (RCE). The vulnerability was disclosed by a GitHub security advisory and affects applications using this vector store component.