PYSEC-2025-249

A critical deserialization vulnerability exists in the run-llama/llamaindex library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle module. JsonPickleSerializer prioritiz...

PT-2022-22812

Name of the Vulnerable Software and Affected Versions rpc.py versions through 0.6.0 Description The issue allows Remote Code Execution because an unpickle occurs when the serializer: pickle HTTP header is sent. Although JSON is the default data format, an unauthenticated client can cause the data...