CVE-2025-3225highCWE-776

CVE-2025-3225: falha de alta gravidade em run-llama/llama_index

XML Entity Expansion vulnerability in run-llama/llama_index

Publicada em

Seguir esta CVE+ Monitorar run-llama/llama index+ Monitorar llama-index

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.5%
An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama_index repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply a malicious Sitemap XML, leading to a Denial of Service (DoS) by exhausting system memory and potentially causing a system crash. The issue is resolved in version v0.12.29.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
run-llama · run-llama/llama_index
CVEs relacionadas — run-llama/llama_index

No mesmo produto, das mais perigosas para as menos.

CVE-2024-3271CRITICALCommand Injection in run-llama/llama_indexEPSS 2.9%CVE-2024-4181HIGHCommand Injection in run-llama/llama_indexEPSS 2.1%CVE-2024-11958CRITICALSQL Injection in run-llama/llama_indexEPSS 1.4%CVE-2024-12909CRITICALSQL Injection to RCE in run-llama/llama_indexEPSS 1.4%CVE-2025-1753HIGHCommand Injection in LLama-Index CLI in run-llama/llama_indexEPSS 1.1%CVE-2024-3098CRITICALPrompt Injection leading to Arbitrary Code Execution in run-llama/llama_indexEPSS 1.0%