Llamaindex EUVD-2025-16964

This vulnerability represents exceptionally high real-world risk. CVSS 9.8 with network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N) indicates trivial exploitation. The attack surface is broad—any web application using llama_index with vector store backends is potentially vulnerable. SQL injection is fully automatable and allows direct data exfiltration or manipulation without requiring additional exploitation steps. The combination of high CVSS, trivial attack requirements, and likely high EPSS score (SQL injection typically scores 0.97+) makes this a critical priority. Without KEV confirmation or POC disclosure data, the actual exploitation timeline is uncertain, but SQL injection is a well-understood attack class with extensive tooling available. Organizations should treat this as requiring emergency patching. The technical impact (CIA triad fully compromised) on confidentiality and integrity is maximum—attackers can read arbitrary data and modify database contents, potentially escalating to application compromise.

An attacker discovers a web application using llama_index v0.12.21 for semantic search over sensitive user data (e.g., customer records, medical information). The application accepts free-text search queries from unauthenticated users. The attacker crafts a malicious search query such as: '; DROP TABLE users; -- or ' OR '1'='1 embedded in the search parameter. This input flows through the llama_index vector store integration to the underlying SQL database without parameterization. The attacker's SQL payload executes with the privileges of the database connection used by the application, allowing them to: (1) extract sensitive data using UNION-based or time-based SQL injection, (2) modify or delete records, (3) potentially escalate privileges within the database. The attack requires no authentication, no user interaction, and can be fully automated using standard SQL injection tools (e.g., sqlmap). A single request can compromise the entire database. No publicly disclosed POC is noted, but the CWE-89 attack class is well-researched with extensive tooling; exploitation is expected to be trivial once the vulnerability is publicly disclosed.