1125 matches found
llama_index JSON Reader DoS
The vulnerability of the llamaindex component of the JSON data reading class, implemented through JSONReader tokens, is related to an uncontrolled recursion. Exploiting this vulnerability could allow a malicious actor to cause service failures...
ag-llama-api (>=0.0.8, <=0.0.31), ag-llama-api-s (>=0.0.4, <=0.0.11) +27 more potentially affected by CVE-2025-14929 via transformers (4.29.2)
transformers PYPI version 4.29.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ag-llama-api =0.0.8, =0.0.4, =0.0.4, =0.0.11, =0.0.3, =0.1.10, =0.2.0, =0.1.0, =0.0.1, =0.5.1.dev20240517, =0.5.2 and more Source cves:...
SQL Injection
llamaindex is vulnerable to SQL Injection. The vulnerability is due to unsafe construction of SQL queries without prepared statements in the duckdbretriever component, which allows an attacker to inject arbitrary SQL commands and execute malicious code...
Persistent Backdoor Attacks under Continual Fine-Tuning of LLMs
Backdoor attacks embed malicious behaviors into Large Language Models LLMs, enabling adversaries to trigger harmful outputs or bypass safety controls. However, the persistence of the implanted backdoors under user-driven post-deployment continual fine-tuning has been rarely examined. Most prior...
Llama-Based Source Code Vulnerability Detection: Prompt Engineering Vs Fine Tuning
The significant increase in software production, driven by the acceleration of development cycles over the past two decades, has led to a steady rise in software vulnerabilities, as shown by statistics published yearly by the CVE program. The automation of the source code vulnerability detection...
Securing Large Language Models (LLMs) from Prompt Injection Attacks
Large Language Models LLMs are increasingly being deployed in real-world applications, but their flexibility exposes them to prompt injection attacks. These attacks leverage the model's instruction-following ability to make it perform malicious tasks. Recent work has proposed JATMO, a task-specif...
Evaluating LLMs for One-Shot Patching of Real and Artificial Vulnerabilities
Automated vulnerability patching is crucial for software security, and recent advancements in Large Language Models LLMs present promising capabilities for automating this task. However, existing research has primarily assessed LLMs using publicly disclosed vulnerabilities, leaving their...
TASO: Jailbreak LLMs Via Alternative Template and Suffix Optimization
Many recent studies showed that LLMs are vulnerable to jailbreak attacks, where an attacker can perturb the input of an LLM to induce it to generate an output for a harmful question. In general, existing jailbreak techniques either optimize a semantic template intended to induce the LLM to produc...
Researchers Find Serious AI Bugs Exposing Meta, Nvidia, and Microsoft Inference Frameworks
Cybersecurity researchers have uncovered critical remote code execution vulnerabilities impacting major artificial intelligence AI inference engines, including those from Meta, Nvidia, Microsoft, and open-source PyTorch projects such as vLLM and SGLang. "These vulnerabilities all traced back to t...
Insecure Temporary File Usage
llama-index-core is vulnerable to Insecure Temporary File Usage. The vulnerability is due to the use of a predictable hardcoded cache directory /tmp/llamaindex in getcachedir, where attackers on multi-user Linux systems can steal cached model data, poison embeddings, or exploit symlink race...
Malicious code in ill-chocolate-llama (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5555ac2c54f83f5d6054d0c5ca3c988693b9e111b21e1e7d6e7350584dd3c05 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-117312
Malicious code in ill-chocolate-llama npm...
EUVD-2025-117162
Malicious code in prepared-red-llama npm...
EUVD-2025-117025
Malicious code in thoughtful-sapphire-llama npm...
MAL-2025-138940 Malicious code in prepared-red-llama (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1a7781454329c1c6b148e3d24e92ef63ac0a34da6bd11cae790b3057bd11cfa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in promising_llama_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e7894edbb5995d297fff6920473eb687d901d6450e7e4398a9fdbcf9e437d35 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-98948
Malicious code in fatalllamaz3n npm...
EUVD-2025-100162
Malicious code in culturalllamaz3n npm...