{"action":"Upgrade llama-index-core to 0.12.41 or later.","affected":[{"fixed":"0.12.41","introduced":"0.11.15"}],"component":"llama-index-core","cve_ids":["CVE-2025-3108"],"ecosystem":"PyPI","epss":0.005,"exploited":false,"fixed_versions":["0.12.41"],"ghsa_id":"GHSA-m84c-4c34-28gf","id":"tcs_01M5KFQKRB8ZXQT83R0VHBQ2MT","modified_at":"2026-07-13T07:26:35.963511267Z","published_at":"2025-07-07T00:30:18Z","references":["https://osv.dev/vulnerability/GHSA-m84c-4c34-28gf","https://nvd.nist.gov/vuln/detail/CVE-2025-3108","https://github.com/run-llama/llama_index/commit/702e4340623092fac4cf2fe95eb9465034856da3","https://github.com/run-llama/llama_index","https://github.com/run-llama/llama_index/blob/v0.12.41/CHANGELOG.md#llama-index-core-01241","https://huntr.com/bounties/9b55a5e8-74e6-4241-b323-e360dc8b110a"],"severity":{"label":"medium","score":5},"sources":[{"source":"osv","source_id":"GHSA-m84c-4c34-28gf","url":"https://osv.dev/vulnerability/GHSA-m84c-4c34-28gf"}],"summary":"LlamaIndex has Incomplete Documentation of Program Execution related to JsonPickleSerializer component"}