LlamaIndex vector store integrations vulnerable to SQL injection
LlamaIndex version v0.12.21 contained critical SQL injection vulnerabilities in several of its vector store integrations. This allowed attackers to potentially execute arbitrary SQL commands by manipulating LLM-generated queries.
The LLM acts as a translator between user input and the database, which opens up new attack vectors.
Key facts
- What
- LlamaIndex version v0.12.21 contained critical SQL injection vulnerabilities in several of its vector store integrations.
- Incident date
- Jun 5, 2025
- Who
- LlamaIndex
- Failure mode
- Prompt Injection
- AI surface
- Search / RAG
- Severity
- High
What happened
A critical SQL injection vulnerability, tracked as CVE-2025-1793, was discovered in LlamaIndex version v0.12.21. The vulnerability affected eight different vector store integrations, including ClickHouse and OracleDB. Attackers could use prompt injection to trick an LLM into generating malicious API calls that executed unsafe SQL queries.
What broke inside the model
- 01 · TriggerThe model reads retrieved or user-supplied text.
- 02 · Model stepThat text carries hidden instructions.
- 03 · Control gapNothing separates untrusted data from trusted commands.
- 04 · FailureThe injected instruction overrides the operator's.
- 05 · ConsequenceThe system acts on an outsider's intent.
At the injection point, retrieved text overrides the operator's instruction.
The failure occurred in methods like vector_store.delete(), which accepted unvalidated inputs and incorporated them directly into raw SQL queries. Because the LLM acted as a translator between user input and the database, it could be manipulated into producing SQL payloads that bypassed intended logic.
What it cost
Sources
- PrimaryCVE-2025-1793cve.org
- PrimarySNYK-PYTHON-LLAMAINDEXCORE-10332647security.snyk.io
- PrimaryCritical SQL Injection Vulnerability in LlamaIndex (CVE-2025-1793) - Advisory and Analysisendorlabs.com
Cite this entry
https://failureindex.ai/failures/llamaindex-vector-store-integrations-vulnerable-sqlAI Failure Index. "LlamaIndex vector store integrations vulnerable to SQL injection" (FI-0568). Realm Labs. https://failureindex.ai/failures/llamaindex-vector-store-integrations-vulnerable-sql (indexed Jun 16, 2026).Data fields CC-BY 4.0, prose citation permitted. Incident ID FI-0568. Full dataset at /data.
Note from Realm Labs, the Index steward
How Realm would have caught this
- Prism
- OmniGuard
Realm inspects the model's internal state for the signature of instructions arriving through the data channel, so an injected command can be flagged and blocked inline before the model acts on it, instead of trusting a classifier that scores the input as safe.