aimon-llamaindex (>=0.0.6, <=0.0.9), aiqtoolkit-llama-index (>=1.1.0a20250429, <=1.2.0rc1) +604 more potentially affected by CVE-2025-3108 via llama-index-core (>=0.11.23, <=0.12.39)

llama-index-core PYPI version =0.11.23, =0.0.6, =1.1.0a20250429, =3.0.0, =1.0.0rc1, =0.2.1.dev3, =0.1.169, =0.3.0, =0.1.0b1, =0.0.52, =0.0.2, =0.0.1, =0.1.2, =0.1.7.dev20240924104148, =0.6.0.dev20241204051808 and more Source cves: CVE-2025-3108 Source advisory: GHSA-M84C-4C34-28GF...

aimon-llamaindex (>=0.0.6, <=0.0.9), aiqtoolkit-llama-index (>=1.1.0a20250429, <=1.2.0rc1) +604 more potentially affected by CVE-2025-3108 via llama-index-core (>=0.11.23, <=0.12.39)

llama-index-core PYPI version =0.11.23, =0.0.6, =1.1.0a20250429, =3.0.0, =1.0.0rc1, =0.2.1.dev3, =0.1.169, =0.3.0, =0.1.0b1, =0.0.52, =0.0.2, =0.0.1, =0.1.2, =0.1.7.dev20240924104148, =0.6.0.dev20241204051808 and more Source cves: CVE-2025-3108 Source advisory: OSV:GHSA-M84C-4C34-28GF...

agentbuddy (0.1.1.dev33), aiqtoolkit-llama-index (>=1.1.0a20250429, <=1.2.0rc1) +88 more potentially affected by CVE-2025-3108 via llama-index (>=0.4.17, <=0.12.38)

llama-index PYPI version =0.4.17, =1.1.0a20250429, =3.0.0, =1.0.5, =1.0.2, =0.0.1, =0.0.33, =0.18.2, =0.3.2, =0.1.1, =0.3.8.0, =1.2.3, =0.1.0, =0.0.8, =0.0.9 and more Source cves: CVE-2025-3108 Source advisory: SNYK:PYTHON-LLAMAINDEX-10645588...

CVE-2025-3108

A critical deserialization vulnerability exists in the run-llama/llamaindex library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle module. JsonPickleSerializer prioritiz...

aimon-llamaindex (>=0.0.6, <=0.0.9), aiqtoolkit-llama-index (>=1.1.0a20250429, <=1.2.0rc1) +604 more potentially affected by CVE-2025-3108 via llama-index-core (>=0.11.23, <=0.12.39)

llama-index-core PYPI version =0.11.23, =0.0.6, =1.1.0a20250429, =3.0.0, =1.0.0rc1, =0.2.1.dev3, =0.1.169, =0.3.0, =0.1.0b1, =0.0.52, =0.0.2, =0.0.1, =0.1.2, =0.1.7.dev20240924104148, =0.6.0.dev20241204051808 and more Source cves: CVE-2025-3108 Source advisory: MEND:CVE-2025-3108...

CVE-2025-3108 Unsafe Deserialization in JsonPickleSerializer Enables Remote Code Execution in run-llama/llama_index

A critical deserialization vulnerability exists in the run-llama/llamaindex library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle module. JsonPickleSerializer prioritiz...

CVE-2025-3108

CVE-2025-3108 affects run-llama/llama_index, specifically the JsonPickleSerializer in versions v0.12.27–v0.12.40. The root cause is an insecure fallback to Python’s pickle during deserialization, enabling remote code execution if untrusted data is processed. The impact can be full system compromi...

CVE-2025-3108 Unsafe Deserialization in JsonPickleSerializer Enables Remote Code Execution in run-llama/llama_index

A critical deserialization vulnerability exists in the run-llama/llamaindex library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle module. JsonPickleSerializer prioritiz...