PyPI/llama-index CVE-2025-1753: high 7.8, EPSS 1.14%
LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the `--files` argument, which is directly passed into `os.system
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 0.12.20 |
Fixed versions
No fixed version in the source.
Sources
- osv: PYSEC-2025-246
- https://github.com/run-llama/llama_index/commit/b57e76738c53ca82d88658b82f2d82d1c7839c7d
- https://huntr.com/bounties/19e1c67e-1d77-451d-b10b-acbe99900b22
CVE-2025-1753 · published · modified · JSON