PyPI/llama-index-vector-stores-duckdb CVE-2025-1750: critical 9.8, EPSS 0.82%

LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id

Action: Upgrade llama-index-vector-stores-duckdb to 0.12.21 or later.

pip install llama-index-vector-stores-duckdb==0.12.21

Affected

Fixed versions

Sources

• osv: PYSEC-2026-4242
• https://nvd.nist.gov/vuln/detail/CVE-2025-1750
• https://github.com/run-llama/llama_index/commit/369a2942df2efcf6b74461c45d20a0af1fbe4ae2
• https://github.com/pypa/advisory-database/tree/main/vulns/llama-index/PYSEC-2025-245.yaml
• https://github.com/run-llama/llama_index
• https://github.com/run-llama/llama_index/releases/tag/v0.12.21
• https://huntr.com/bounties/e1302233-9180-4269-9047-1526247d2cd8
• https://pypi.org/project/llama-index-vector-stores-duckdb
• https://github.com/advisories/GHSA-6mcc-q3mg-3qg6

CVE-2025-1750 · published 2026-10-15T10:22:42.591402Z · modified 2026-10-15T14:56:11.668398293Z · JSON