EUVD-2025-25708

Malicious code in bioql PyPI...

CVE-2025-5302 Denial of Service (DOS) in JSONReader in run-llama/llama_index

A denial of service vulnerability exists in the JSONReader component of the run-llama/llamaindex repository, specifically in version v0.12.37. The vulnerability is caused by uncontrolled recursion when parsing deeply nested JSON files, which can lead to Python hitting its maximum recursion depth...

PT-2025-34665

Name of the Vulnerable Software and Affected Versions: run-llama/llama index versions prior to 0.12.38 Description: A denial of service issue exists in the JSONReader component. The issue is caused by uncontrolled recursion when parsing deeply nested JSON files, which can lead to Python hitting i...

CVE-2024-12911 SQL Injection in run-llama/llama_index

A vulnerability in the defaultjsonalyzer function of the JSONalyzeQueryEngine in the run-llama/llamaindex repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service DoS attacks. The vulnerability affects the latest version and is fixed...

CVE-2024-12909

CVE-2024-12909 affects the FinanceChatLlamaPack within the run-llama/llama_index project (up to v0.12.3). The root cause is an SQL injection in the database_agent’s run_sql_query function, which can be exploited to inject arbitrary SQL and trigger remote code execution through PostgreSQL large ob...