CVE-2025-1753

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-1753

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-1753.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-1753

Aliases

Published

2025-05-28T09:34:10.993Z

Modified

2026-07-15T01:49:03.617787410Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Command Injection in LLama-Index CLI in run-llama/llama_index

Details

LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the --files argument, which is directly passed into os.system. An attacker who controls the content of this argument can inject and execute arbitrary shell commands. This vulnerability can be exploited locally if the attacker has control over the CLI arguments, and remotely if a web application calls the LLama-Index CLI with a user-controlled filename. This issue can lead to arbitrary code execution on the affected system.

Database specific

{
    "cwe_ids": [
        "CWE-78"
    ],
    "cna_assigner": "@huntr_ai",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1753.json"
}

References

Affected packages

Git / github.com/run-llama/llama_index

Affected ranges

Type

GIT

Repo

https://github.com/run-llama/llama_index

Events

Introduced

6c72f27ab52a8214a4a496aaf876a296061fad57

Fixed

b57e76738c53ca82d88658b82f2d82d1c7839c7d

Database specific

{
    "cpe": "cpe:2.3:a:llamaindex:llamaindex:0.12.20:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0.12.20"
        },
        {
            "last_affected": "0.12.20"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.12.20

v0.*

v0.12.20

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-1753.json"