fix(llama-index-vector-stores-db2): escape SQL string literals to prevent injection

[pwilkin]

Summary

Fixes SQL injection vulnerabilities in the IBM Db2 vector store (llama-index-vector-stores-db2). This package was added after CVE-2025-1793 (multi-store SQLi) was patched, but was not included in that fix — it contains the same vulnerable pattern of f-string interpolation of user-controlled values into SQL.

Vulnerability Details

Three sinks are patched:

1. delete(ref_doc_id) at base.py:333

   • ddl = f"DELETE FROM {self.table_name} WHERE doc_id = '{ref_doc_id}'"
   • User-controlled ref_doc_id is interpolated without escaping.

2. query() via _stringify_list(query.doc_ids) at base.py:117 + 349

   • where_str = f"doc_id in {_stringify_list(query.doc_ids)}"
   • Items in the list are wrapped in single quotes without escaping.

3. query() via _append_meta_filter_condition at base.py:271

   • filter_str = f"JSON_VALUE(..., '$.{filter_item.key}') = '{filter_item.value}'"
   • Both key and value are interpolated without escaping.

Fix

Applied _escape_str() (existing helper) to all user-controlled string values interpolated into SQL. Also corrected _escape_str() to use Db2-standard quote-doubling ('') instead of backslash escaping, which Db2 does not support.

Verification

• PoC confirmed all three sinks are exploitable in main
• PoC re-run after patch confirms all three sinks are closed
• Legitimate operations (delete, query with doc_ids, query with filters) still work correctly

Related

• CVE-2025-1793: same bug class, different stores (fixed in PR fix: patch multiple sql-injection vulnerabilities #18316 — Db2 was not included)
• Disclosure report: https://huntr.com/bounties/eed3f4fc-bc47-4332-9cf1-c9635584fb5b

[pwilkin]

Note: some other stores added after the previous CVE fix are also vulnerable since they have the same lack-of-sanitation bug (azurecosmos, alibabacloud-openserach, azureaisearch, dashvector), but they're not SQL stores so likely less severe (still should probably be patched).