LlamaIndex DuckDBVectorStore has an SQL injection vulnerability
Start here
A GitHub security advisory disclosed that the DuckDBVectorStore delete function in run-llama/llama_index v0.12.19 has an SQL injection vulnerability. An attacker can read and write arbitrary files on the server by manipulating the ref_doc_id parameter, which may lead to remote code execution (RCE). This vulnerability affects applications using this vector store component.
Generated by AI from reports · Updated 5 days ago
Progress timeline
- GitHub 安全公告LlamaIndex DuckDBVectorStore has an SQL injection vulnerability due to ref_doc_id
The DuckDBVectorStore delete function in run-llama/llama_index v0.12.19 has an SQL injection vulnerability. An attacker can read and write arbitrary files on the server by manipulating the ref_doc_id parameter, and it may lead to remote code execution (RCE). The vulnerability was disclosed by a GitHub security advisory and affects applications using this vector store component.
Related discussion
Attention trend
New sources per day
- Oct 3: 1 new sources (1 outlets, 0 accounts)
- Oct 4: 0 new sources (0 outlets, 0 accounts)
- Oct 5: 0 new sources (0 outlets, 0 accounts)
- Oct 6: 0 new sources (0 outlets, 0 accounts)
- Oct 7: 0 new sources (0 outlets, 0 accounts)
- Oct 8: 0 new sources (0 outlets, 0 accounts)
- Oct 9: 0 new sources (0 outlets, 0 accounts)
- Oct 10: 0 new sources (0 outlets, 0 accounts)
- Oct 11: 0 new sources (0 outlets, 0 accounts)
- Oct 12: 0 new sources (0 outlets, 0 accounts)
- Oct 13: 0 new sources (0 outlets, 0 accounts)
- Oct 14: 0 new sources (0 outlets, 0 accounts)