PyPI/llama-index CVE-2025-3044: medium 5.3, EPSS 0.32%
A vulnerability in the ArxivReader class of the run-llama/llama_index repository, versions up to v0.12.22.post1, allows for MD5 hash collisions when generating filenames for downloaded papers. This ca
Action: Upgrade llama-index to 0.12.28 or later.
pip install llama-index==0.12.28Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.12.28 | - |
Fixed versions
| 0.12.28 |
Sources
- osv: PYSEC-2025-247
- https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e
- https://huntr.com/bounties/80182c3a-876f-422f-8bac-38267e0345d6
CVE-2025-3044 · published · modified · JSON