LLama-Index CLI OS command injection vulnerability

LLama-Index CLI prior to v0.4.1, corresponding to LLama-Index prior to v0.12.21, contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the --files argument, which is directly passed into os.system. An attacker who controls the content of this...

airunner (>=3.0.0, <=3.1.7), edubotics-core (>=0.1.3, <=0.1.7) +23 more potentially affected by CVE-2025-1753 via llama-index-cli (>=0.1.5, <=0.4.0)

llama-index-cli PYPI version =0.1.5, =3.0.0, =0.1.3, =0.1.169, =0.1.3, =0.3.0, =0.0.52, =1.0.9, =1.0.3.post1, =0.1.2, =0.1.7.dev20240924104148, =0.11.0, =0.1.4, =0.2.0 and more Source cves: CVE-2025-1753 Source advisory: OSV:PYSEC-2026-1557...

EUVD-2025-16322

Malicious code in bioql PyPI...

OS Command Injection

LLama-Index CLI is vulnerable to OS Command Injection. The vulnerability is due to improper input handling due to unsanitized use of the --files argument passed directly into os.system, allowing arbitrary command execution...

airunner (>=3.0.0, <=3.1.7), edubotics-core (>=0.1.3, <=0.1.7) +23 more potentially affected by CVE-2025-1753 via llama-index-cli (>=0.1.5, <=0.4.0)

llama-index-cli PYPI version =0.1.5, =3.0.0, =0.1.3, =0.1.169, =0.1.3, =0.3.0, =0.0.52, =1.0.9, =1.0.3.post1, =0.1.2, =0.1.7.dev20240924104148, =0.11.0, =0.1.4, =0.2.0 and more Source cves: CVE-2025-1753 Source advisory: OSV:GHSA-G99H-56MW-8263...

PYSEC-2025-246

LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the --files argument, which is directly passed into os.system. An attacker who controls the content of this argument can inject and execute arbitrary shell...

CVE-2025-1753

LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the --files argument, which is directly passed into os.system. An attacker who controls the content of this argument can inject and execute arbitrary shell...

CVE-2025-1753 Command Injection in LLama-Index CLI in run-llama/llama_index

LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the --files argument, which is directly passed into os.system. An attacker who controls the content of this argument can inject and execute arbitrary shell...

CVE-2025-1753 Command Injection in LLama-Index CLI in run-llama/llama_index

LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the --files argument, which is directly passed into os.system. An attacker who controls the content of this argument can inject and execute arbitrary shell...

CVE-2025-1753

LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the "--files" argument, which is directly passed into "os.system". An attacker who controls the content of this argument can inject and execute arbitrary shell...

airunner (>=3.0.0, <=3.1.7), edubotics-core (>=0.1.3, <=0.1.7) +23 more potentially affected by CVE-2025-1753 via llama-index-cli (>=0.1.5, <=0.4.0)

llama-index-cli PYPI version =0.1.5, =3.0.0, =0.1.3, =0.1.169, =0.1.3, =0.3.0, =0.0.52, =1.0.9, =1.0.3.post1, =0.1.2, =0.1.7.dev20240924104148, =0.11.0, =0.1.4, =0.2.0 and more Source cves: CVE-2025-1753 Source advisory: SNYK:PYTHON-LLAMAINDEXCLI-10265935...

Command Injection

Overview llama-index-cli is a llama-index cli Affected versions of this package are vulnerable to Command Injection through the CLI interface due to pasting the --files argument directly into os.system. An attacker who controls the content of this argument can execute arbitrary commands on the...

CVE-2025-1753: Improper Neutralization of Special Elements used in an OS Command

LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the --files argument, which is directly passed into os.system. An attacker who controls the content of this argument can inject and execute arbitrary shell...

PT-2025-23074

Name of the Vulnerable Software and Affected Versions LLama-Index CLI version v0.12.20 Description The LLama-Index CLI contains an OS command injection issue due to the improper handling of the --files argument, which is directly passed into os.system. This allows an attacker who controls the...

Command injection in LLama-Index CLI

Description There is an OS command injection vulnerability in the LLama-Index CLI. Because of pasting the --files argument directly into os.system, an attacker who controls the content of this argument can inject shell commands. The vulnerability was marked as "Local" in the CVSS rating because t...