CVE-2025-3225 XML Entity Expansion vulnerability in run-llama/llama_index

An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llamaindex repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply a malicious Sitemap XML, leading to a Denial of Service DoS...

CVE-2025-3225

The CVE-2025-3225 issue affects the run-llama/llama_index project, specifically its sitemap parser, where an XML Entity Expansion (billion laughs) vulnerability exists in version v0.12.21. This can be triggered by a malicious Sitemap XML to cause Denial of Service via memory exhaustion, potential...

CVE-2025-3225

An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llamaindex repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply a malicious Sitemap XML, leading to a Denial of Service DoS...

aimon-llamaindex (>=0.0.6, <=0.0.9), aiqtoolkit-llama-index (>=1.1.0a20250429, <=1.2.0rc1) +603 more potentially affected by CVE-2025-3108 via llama-index-core (>=0.11.23, <=0.12.39)

llama-index-core PYPI version =0.11.23, =0.0.6, =1.1.0a20250429, =3.0.0, =1.0.0rc1, =0.2.1.dev3, =0.1.169, =0.3.0, =0.1.0b1, =0.0.52, =0.0.2, =0.0.1, =0.1.2, =0.1.7.dev20240924104148, =0.6.0.dev20241204051808 and more Source cves: CVE-2025-3108 Source advisory: GHSA-M84C-4C34-28GF...

aimon-llamaindex (>=0.0.6, <=0.0.9), aiqtoolkit-llama-index (>=1.1.0a20250429, <=1.2.0rc1) +603 more potentially affected by CVE-2025-3108 via llama-index-core (>=0.11.23, <=0.12.39)

llama-index-core PYPI version =0.11.23, =0.0.6, =1.1.0a20250429, =3.0.0, =1.0.0rc1, =0.2.1.dev3, =0.1.169, =0.3.0, =0.1.0b1, =0.0.52, =0.0.2, =0.0.1, =0.1.2, =0.1.7.dev20240924104148, =0.6.0.dev20241204051808 and more Source cves: CVE-2025-3108 Source advisory: OSV:GHSA-M84C-4C34-28GF...

CVE-2025-5472: Uncontrolled Recursion

The JSONReader in run-llama/llamaindex versions 0.12.28 is vulnerable to a stack overflow due to uncontrolled recursive JSON parsing. This vulnerability allows attackers to trigger a Denial of Service DoS by submitting deeply nested JSON structures, leading to a RecursionError and crashing...

CVE-2025-3046: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the ObsidianReader class of the run-llama/llamaindex repository, versions 0.12.23 to 0.12.28, allows for arbitrary file read through symbolic links. The ObsidianReader fails to resolve symlinks to their real paths and does not validate whether the resolved paths lie within the...

CVE-2025-3225: Improper Restriction of Recursive Entity References in DTDs

An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llamaindex repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply a malicious Sitemap XML, leading to a Denial of Service DoS...

PT-2025-28163

Name of the Vulnerable Software and Affected Versions: run-llama/llama index versions 0.12.27 through 0.12.40 Description: A path traversal vulnerability exists, specifically within the encode image function in generic utils.py, allowing an attacker to manipulate the image path input to read...

PT-2025-28149

Name of the Vulnerable Software and Affected Versions: llama index versions v0.12.21 through v0.12.28 Description: An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama index repository. This issue allows an attacker to...

CVE-2025-6209: Path Traversal: '\..\filename'

A path traversal vulnerability exists in run-llama/llamaindex versions 0.12.27 through 0.12.40, specifically within the encodeimage function in genericutils.py. This vulnerability allows an attacker to manipulate the imagepath input to read arbitrary files on the server, including sensitive syste...

CVE-2025-6210: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the ObsidianReader class of the run-llama/llamaindex repository, specifically in version 0.12.27, allows for hardlink-based path traversal. This flaw permits attackers to bypass path restrictions and access sensitive system files, such as /etc/passwd, by exploiting hardlinks. T...

Deserialization of Untrusted Data

Overview llama-index-core is an Interface between LLMs and your data Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JsonPickleSerializer process. An attacker can execute arbitrary code by submitting specially crafted serialized data that triggers the...

agentbuddy (0.1.1.dev33), aiqtoolkit-llama-index (>=1.1.0a20250429, <=1.2.0rc1) +88 more potentially affected by CVE-2025-3108 via llama-index (>=0.4.17, <=0.12.38)

llama-index PYPI version =0.4.17, =1.1.0a20250429, =3.0.0, =1.0.5, =1.0.2, =0.0.1, =0.0.33, =0.18.2, =0.3.2, =0.1.1, =0.3.8.0, =1.2.3, =0.1.0, =0.0.8, =0.0.9 and more Source cves: CVE-2025-3108 Source advisory: SNYK:PYTHON-LLAMAINDEX-10645588...

Deserialization of Untrusted Data

Overview llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the JsonPickleSerializer process. An attacker can execute arbitrary code by submitting specially crafted serialized data that triggers the...

aimon-llamaindex (>=0.0.6, <=0.0.9), aiqtoolkit-llama-index (>=1.1.0a20250429, <=1.2.0rc1) +671 more potentially affected by CVE-2025-3108 via llama-index-core (>=0.9.56, <=0.12.39)

llama-index-core PYPI version =0.9.56, =0.0.6, =1.1.0a20250429, =3.0.0, =1.0.0, =0.0.3, =1.0.0rc1, =0.2.1.dev0, =0.2.1.dev0, =0.1.3, =0.1.169, =0.1.3, =0.3.0, =0.1.0b1, =0.0.52, =0.0.2, =0.0.5 and more Source cves: CVE-2025-3108 Source advisory: SNYK:PYTHON-LLAMAINDEXCORE-10645589...

PYSEC-2025-249

A critical deserialization vulnerability exists in the run-llama/llamaindex library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle module. JsonPickleSerializer prioritiz...

PYSEC-2025-249

A critical deserialization vulnerability exists in the run-llama/llamaindex library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle module. JsonPickleSerializer prioritiz...

appscriptz (>=1.0.5, <=1.0.6), contributor-1 (0.2.0) +7 more potentially affected by CVE-2025-3108 via llama-index (>=0.12.30, <=0.12.38)

llama-index PYPI version =0.12.30, =1.0.5, =0.2.53, =1.0.4, =1.1.0a20251020, =1.4.0a20251015 - promptlibz 1.0.2 Source cves: CVE-2025-3108 Source advisory: OSV:PYSEC-2025-249...

aimon-llamaindex (>=0.0.6, <=0.0.9), aiqtoolkit-llama-index (>=1.1.0a20250429, <=1.2.0rc1) +603 more potentially affected by CVE-2025-3108 via llama-index-core (>=0.11.23, <=0.12.39)

llama-index-core PYPI version =0.11.23, =0.0.6, =1.1.0a20250429, =3.0.0, =1.0.0rc1, =0.2.1.dev3, =0.1.169, =0.3.0, =0.1.0b1, =0.0.52, =0.0.2, =0.0.1, =0.1.2, =0.1.7.dev20240924104148, =0.6.0.dev20241204051808 and more Source cves: CVE-2025-3108 Source advisory: MEND:CVE-2025-3108...