PyPI/llama-index CVE-2025-3046: high 7.5, EPSS 0.64%
A vulnerability in the `ObsidianReader` class of the run-llama/llama_index repository, versions 0.12.23 to 0.12.28, allows for arbitrary file read through symbolic links. The `ObsidianReader` fails to
Action: Upgrade llama-index to 0.12.28 or later.
pip install llama-index==0.12.28Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.12.23 | 0.12.28 | - |
Fixed versions
| 0.12.28 |
Sources
- osv: PYSEC-2025-248
- https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e
- https://huntr.com/bounties/90a1f1b2-bb82-4d66-9fc1-856ed5f904da
CVE-2025-3046 · published · modified · JSON