Database/AI/ML frameworks & serving
LlamaIndex (vector store integrations): SQL injection across multiple vector store integrations
CVSS 9.8CVE-2025-1793AI/ML frameworks & servingcurated
Impact
SQL injection across multiple vector store integrations
Who can reach it
Attacker-influenced query/metadata reaching the store
What to do
Upgrade past 0.12.21
References
Related entries
- picklescan (model scanner): Scanner fails to detect malicious pickles when ZIP flag bits are flippedCVE-2025-1945 · picklescan (model scanner)Critical
- NVIDIA Triton: Stack buffer overflowCVE-2025-23310 · NVIDIA TritonCritical
- NVIDIA Triton: Stack overflow via crafted requestCVE-2025-23311 · NVIDIA TritonCritical
- NVIDIA Triton Inference Server (Python backend): Attacker-controlled input in the Python backendCVE-2025-23316 · NVIDIA Triton Inference Server (Python backend)Critical
- BentoML: RCE via insecure deserializationCVE-2025-27520 · BentoMLCritical
- BentoML: Insecure deserialization RCE prior to 1.4.8CVE-2025-32375 · BentoMLCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.