{"action":"Upgrade llama-index to 0.12.28 or later.","affected":[{"fixed":"0.12.28","introduced":"0"}],"component":"llama-index","cve_ids":["CVE-2025-3044"],"ecosystem":"PyPI","epss":0.00323,"exploited":false,"fixed_versions":["0.12.28"],"ghsa_id":"GHSA-p7j4-jwjf-5x9w","id":"tcs_01M5KGPE1FJDRTK3E4BJ2AP9HK","modified_at":"2026-07-13T07:26:33.379116779Z","published_at":"2025-07-07T10:15:26.717Z","references":["https://osv.dev/vulnerability/PYSEC-2025-247","https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e","https://huntr.com/bounties/80182c3a-876f-422f-8bac-38267e0345d6"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"PYSEC-2025-247","url":"https://osv.dev/vulnerability/PYSEC-2025-247"}],"summary":"A vulnerability in the ArxivReader class of the run-llama/llama_index repository, versions up to v0.12.22.post1, allows for MD5 hash collisions when generating filenames for downloaded papers. This ca"}