Skip to content
OpenAdvisories

Vendor

run-llama

26 known vulnerabilities.

Products

run-llama/llama_index 24 llama_index 2
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-6208

    Uncontrolled Memory Consumption in run-llama/llama_index

    The `SimpleDirectoryReader` component in `llama_index.core` version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The vulnerability arises because the user-specified file limit (`num_files_limit`) is applied after all…

    run-llama run-llama/llama_index llama-index-core PyPI
  • Medium 6.5
    CVE-2025-6211

    MD5 Hash Collision in run-llama/llama_index

    A vulnerability in the DocugamiReader class of the run-llama/llama_index repository, up to version 0.12.28, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain i…

    run-llama run-llama/llama_index llama-index llama-index-readers-docugami PyPI
  • Medium 6.5
    CVE-2025-5472

    Denial of Service via Uncontrolled Recursive JSON Parsing in JSONReader in run-llama/llama_index

    The JSONReader in run-llama/llama_index versions 0.12.28 is vulnerable to a stack overflow due to uncontrolled recursive JSON parsing. This vulnerability allows attackers to trigger a Denial of Service (DoS) by submitting deeply nested JSON structures, leadin…

    run-llama run-llama/llama_index llama-index llama-index-core PyPI
  • Medium 6.2
    CVE-2025-6210

    Hardlink-Based Path Traversal in run-llama/llama_index

    A vulnerability in the ObsidianReader class of the run-llama/llama_index repository, specifically in version 0.12.27, allows for hardlink-based path traversal. This flaw permits attackers to bypass path restrictions and access sensitive system files, such as …

    run-llama run-llama/llama_index llama-index llama-index-readers-obsidian PyPI
  • Medium 5.3
    CVE-2025-3044

    MD5 Hash Collision in run-llama/llama_index

    A vulnerability in the ArxivReader class of the run-llama/llama_index repository, versions up to v0.12.22.post1, allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but dif…

    run-llama run-llama/llama_index llama-index llama-index-readers-papers PyPI
  • Medium 5.0
    CVE-2025-3108

    Unsafe Deserialization in JsonPickleSerializer Enables Remote Code Execution in run-llama/llama_index

    A critical deserialization vulnerability exists in the run-llama/llama_index library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle…

    run-llama run-llama/llama_index llama-index llama-index-core PyPI
  • Medium 4.2
    CVE-2024-12910

    Denial of Service in run-llama/llama_index

    A vulnerability in the `KnowledgeBaseWebReader` class of the run-llama/llama_index repository, version latest, allows an attacker to cause a Denial of Service (DoS) by controlling a URL variable to contain the root URL. This leads to infinite recursive calls …

    run-llama run-llama/llama_index llama-index PyPI