LlamaIndex has an XML Entity Expansion vulnerability in its sitemap parser

An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llamaindex repository, specifically affecting the Papers Loaders package before version 0.3.2 in llama-index v0.10.0 and above through v0.12.29. This vulnerability allows ...

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Overview llama-index-readers-web is a llama-index readers web integration Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' via the parsesitemap function. An attacker can exhaust system memory and potentially cau...

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Overview llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' via the parsesitemap function. An attacker can exhaust system memory and potentially cause a syste...

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Overview llama-index-readers-stripe-docs is a llama-index readers stripedocs integration Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' via the parsesitemap function. An attacker can exhaust system memory and...

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Overview llama-index-readers-papers is a llama-index readers papers integration Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs 'XML Entity Expansion' via the parsesitemap function. An attacker can exhaust system memory and potential...

CVE-2025-3225

An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llamaindex repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply a malicious Sitemap XML, leading to a Denial of Service DoS...

PYSEC-2025-250

An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llamaindex repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply a malicious Sitemap XML, leading to a Denial of Service DoS...

CVE-2025-3225 XML Entity Expansion vulnerability in run-llama/llama_index

An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llamaindex repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply a malicious Sitemap XML, leading to a Denial of Service DoS...

CVE-2025-3225 XML Entity Expansion vulnerability in run-llama/llama_index

An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llamaindex repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply a malicious Sitemap XML, leading to a Denial of Service DoS...

CVE-2025-3225 XML Entity Expansion vulnerability in run-llama/llama_index

An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llamaindex repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply a malicious Sitemap XML, leading to a Denial of Service DoS...

CVE-2025-3225

The CVE-2025-3225 issue affects the run-llama/llama_index project, specifically its sitemap parser, where an XML Entity Expansion (billion laughs) vulnerability exists in version v0.12.21. This can be triggered by a malicious Sitemap XML to cause Denial of Service via memory exhaustion, potential...

LlamaIndex 安全漏洞

LlamaIndex is a data framework for LLM applications from the LlamaIndex open source. A security vulnerability exists in LlamaIndex version 0.12.21, which stems from an XML entity extension vulnerability in the sitemap parser that could lead to a denial of service attack...

PT-2025-28149

Name of the Vulnerable Software and Affected Versions: llama index versions v0.12.21 through v0.12.28 Description: An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama index repository. This issue allows an attacker to...

MAL-2025-5634 Malicious code in token-renewal (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de8c5eaca0b97fb9aad23e47e1d86057e671884d4b4f12781413b41d3d01e358 Any computer that has this package installed or running should be considered...

Exploit for CVE-2025-49493

CVE-2025-49493 Akamai CloudTest - XXE Injection ☁️ 📄 Descr...

PT-2025-67: XML external entity leads to Local File Read and Server-side request forgery in FastReport.NET

The vulnerability was identified in FastReport .NET, versions 2024.2.20. The discovered vulnerability, due to the ability to inject and expand external entities, can be exploited by an attacker to read arbitrary local files and perform server‑side request forgery SSRF with full response retrieval...

Malicious code in n8n-nodes-zalo-user-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5b947fc267d5c40a50dc48860ddebb3d7ab7b78e58d65e0b97ddec970698856 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DRUPAL-CONTRIB-2025-086

This module enables you to use config\pages as a content entity. The module doesn't check permission or entity access before rendering config\pages content...

Malicious code in solana-dextrade-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b8f89467fb69d00785530ca32444043368fe523570c7f428d485319782d845a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in env-info-checker-kyy3w4fiurevd8uy43wfre (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d6fb3feadb029e83e642c54a8ffc29782d65e981a2bd769dc972463231215b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...