Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id

Fix availableCritical · CVSS 9.8EPSS 0.82%

Published Jun 2, 2025 · updated Oct 2, 2026

What to do

  1. Upgrade to a fixed version: llama-index-vector-stores-duckdb 0.12.21.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

PyPIllama-index-vector-stores-duckdb197 downloads/week

Vulnerable versions
>= 0.12.19, < 0.12.21
Fixed in
0.12.21

Check your project: pip show llama-index-vector-stores-duckdb

Sources

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

← All critical vulnerabilities