PyPI/llama-index-readers-obsidian CVE-2025-3046: high 7.5, EPSS 0.64%
LlamaIndex is vulnerable to Path Traversal attack through its ObsidianReader class
Action: Upgrade llama-index-readers-obsidian to 0.5.1 or later.
pip install llama-index-readers-obsidian==0.5.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.5.1 | - |
Fixed versions
| 0.5.1 |
Sources
- osv: PYSEC-2026-1568
- https://nvd.nist.gov/vuln/detail/CVE-2025-3046
- https://github.com/run-llama/llama_index/pull/18320
- https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e
- https://github.com/run-llama/llama_index/commit/266eb3b3a61f158112726d75a5f5f0b90e34ded0
- https://github.com/run-llama/llama_index
- https://huntr.com/bounties/90a1f1b2-bb82-4d66-9fc1-856ed5f904da
- https://pypi.org/project/llama-index-readers-obsidian
- https://github.com/advisories/GHSA-fmrf-6jv9-qjc7
CVE-2025-3046 · published · modified · JSON