aiqtoolkit-llama-index (>=1.1.0 <=1.2.0rc4), airunner (>=3.0.0 <=3.1.14) +34 more potentially affected by CVE-2025-3044 via llama-index (>=0.10.0 <=0.12.22)

llama-index PYPI version =0.10.0, =1.1.0, =3.0.0, =1.7.0, =0.1.3, =0.1.169, =0.1.0, =0.3.0, =0.0.52, =1.0.9, =1.0.3.post1, =0.1.2, =0.1.7.dev20240924104148, =0.1.0, =0.2.0 and more Source cves: CVE-2025-3044 Source advisory: SNYK:PYTHON-LLAMAINDEX-10645579...

PYSEC-2025-247

A vulnerability in the ArxivReader class of the run-llama/llamaindex repository, versions up to v0.12.22.post1, allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each othe...