LlamaIndex CLI: OS command injection via the `--files` argument

CVE-2025-1753AI/ML frameworks & servingcurated

Impact

OS command injection via the --files argument

Who can reach it

Attacker-influenced filename in an automated pipeline

What to do

Upgrade past 0.12.20

References

https://nvd.nist.gov/vuln/detail/CVE-2025-1753

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.