CVE-2025-1753

NONE EPSS 59.4%
Published May 28, 20251y ago · Modified Jun 17, 20261w ago
Find Similar
Published May 28, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the `--files` argument, which is directly passed into `os.system`. An attacker who controls the content of this argument can inject and execute arbitrary shell commands. This vulnerability can be exploited locally if the attacker has control over the CLI arguments, and remotely if a web application calls the LLama-Index CLI with a user-controlled filename. This issue can lead to arbitrary code execution on the affected system.

Threat Intelligence

EPSS Exploit Probability
59.4% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-78 OS Command Injection Injection

Affected Products 1

VendorProductVersionRange
llamaindexllamaindex0.12.20any

References 2

  • github.com https://github.com/run-llama/llama_index/commit/b57e76738c53ca82d88658b82f2d82d1c7839c7d
    Patch
  • huntr.com https://huntr.com/bounties/19e1c67e-1d77-451d-b10b-acbe99900b22
    ExploitThird Party Advisory

Remediation

  • github.com https://github.com/run-llama/llama_index/commit/b57e76738c53ca82d88658b82f2d82d1c7839c7d
    Patch