PyPI/llama-index CVE-2025-6210: medium 6.2, EPSS 0.33%
A vulnerability in the ObsidianReader class of the run-llama/llama_index repository, specifically in version 0.12.27, allows for hardlink-based path traversal. This flaw permits attackers to bypass pa
Action: Upgrade llama-index to 0.5.2 or later.
pip install llama-index==0.5.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.5.2 | - |
Fixed versions
| 0.5.2 |
Sources
- osv: PYSEC-2025-252
- https://github.com/run-llama/llama_index/commit/a86c96ae0e662492eeb471b658ae849a93f628ff
- https://huntr.com/bounties/a654b322-a509-4448-a1f5-0f22850b4687
CVE-2025-6210 · published · modified · JSON