Pentesting-Assistant

Pentesting-Assistant AI-powered penetration testing assist...

CVE-2025-7647: Creation of Temporary File With Insecure Permissions

The llama-index-core package, up to version 0.12.44, contains a vulnerability in the getcachedir function where a predictable, hardcoded directory path /tmp/llamaindex is used on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in llama_index-0.12.29-py3-none-any.whl

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of llamaindex-0.12.29-py3-none-any.whl Vulnerability Details CVEID:CVE-2025-1793 DESCRIPTION: Multiple vector store integrations in run-llama/llamaindex version v0.12.21 have SQL injection vulnerabilities. These vulnerabiliti...

lightspeed-stack (>=0.1.1, <=0.2.0), lightspeed-stack-providers (>=0.1.10, <=0.1.15) +3 more potentially affected by CVE-2025-55178 via llama-stack (>=0.2.9, <=0.2.18)

llama-stack PYPI version =0.2.9, =0.1.1, =0.1.10, =1.0.1, =0.2.0, =0.3.0a0 Source cves: CVE-2025-55178 Source advisory: SNYK:PYTHON-LLAMASTACK-13109624...

Cross-site Scripting (XSS)

Overview llama-stack is a Llama Stack Affected versions of this package are vulnerable to Cross-site Scripting XSS via the resolveastbytype function. An attacker can modify application behavior or execute unauthorized actions by supplying unverified parameters. Details Cross-site scripting or XSS...

lightspeed-stack (>=0.1.1, <=0.2.0), lightspeed-stack-providers (>=0.1.10, <=0.1.15) +3 more potentially affected by CVE-2025-55178 via llama-stack (>=0.2.9, <=0.2.18)

llama-stack PYPI version =0.2.9, =0.1.1, =0.1.10, =1.0.1, =0.2.0, =0.3.0a0 Source cves: CVE-2025-55178 Source advisory: GHSA-X75H-M6JJ-6CJ2...

Llama Stack could potentially allow for remote code execution

Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolveastbytype function which could potentially allow for remote code execution...

lightspeed-stack (>=0.1.1, <=0.2.0), lightspeed-stack-providers (>=0.1.10, <=0.1.15) +3 more potentially affected by CVE-2025-55178 via llama-stack (>=0.2.9, <=0.2.18)

llama-stack PYPI version =0.2.9, =0.1.1, =0.1.10, =1.0.1, =0.2.0, =0.3.0a0 Source cves: CVE-2025-55178 Source advisory: OSV:GHSA-X75H-M6JJ-6CJ2...

GHSA-X75H-M6JJ-6CJ2 Llama Stack could potentially allow for remote code execution

Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolveastbytype function which could potentially allow for remote code execution...

CVE-2025-55178

Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolveastbytype function which could potentially allow for remote code execution...

CVE-2025-55178

Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolveastbytype function which could potentially allow for remote code execution...

CVE-2025-55178

Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolveastbytype function which could potentially allow for remote code execution...

lightspeed-stack (>=0.1.1, <=0.2.0), lightspeed-stack-providers (>=0.1.10, <=0.1.15) +3 more potentially affected by CVE-2025-55178 via llama-stack (>=0.2.9, <=0.2.18)

llama-stack PYPI version =0.2.9, =0.1.1, =0.1.10, =1.0.1, =0.2.0, =0.3.0a0 Source cves: CVE-2025-55178 Source advisory: MEND:CVE-2025-55178...

CVE-2025-55178

Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolveastbytype function which could potentially allow for remote code execution...

CVE-2025-55178

Versions of llama-stack prior to v0.2.20 are vulnerable to Remote Code Execution (RCE) because the resolve_ast_by_type function accepts unverified parameters. An attacker can supply malicious input to achieve arbitrary code execution. Additionally, the resolve_ast_by_type function is noted as vul...

CVE-2025-55178

Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolveastbytype function which could potentially allow for remote code execution...

CVE-2025-55178: Undefined Security Weakness

Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolveastbytype function which could potentially allow for remote code execution...

PT-2025-39321

Name of the Vulnerable Software and Affected Versions Llama Stack versions prior to 0.2.20 Description The software accepts unverified parameters in the resolve ast by type function, which may allow for remote code execution. Recommendations Update to version 0.2.20 or later...

Llama Stack security vulnerabilities

Llama Stack is a model component of the Llama Stack API open-sourced by Meta Llama. A security vulnerability exists in Llama Stack versions prior to v0.2.20, which stems from the resolveastbytype function accepting unvalidated parameters, which could lead to remote code execution...

Denial Of Service (DoS)

llamaindexcore is vulnerable to Denial of Service DoS. The vulnerability is due to uncontrolled recursion when parsing deeply nested JSON files, which allows an attacker to cause high resource consumption and potential crashes of the Python process...