{"action":"Upgrade llama-index to 0.12.41 or later.","affected":[{"fixed":"0.12.41","introduced":"0.12.27"}],"component":"llama-index","cve_ids":["CVE-2025-3108"],"ecosystem":"PyPI","epss":0.005,"exploited":false,"fixed_versions":["0.12.41"],"ghsa_id":"GHSA-m84c-4c34-28gf","id":"tcs_01M5KGPEACVQPF0NBHBF967H8X","modified_at":"2026-07-13T07:26:35.963511267Z","published_at":"2025-07-06T23:15:21.777Z","references":["https://osv.dev/vulnerability/PYSEC-2025-249","https://github.com/run-llama/llama_index/commit/702e4340623092fac4cf2fe95eb9465034856da3","https://huntr.com/bounties/9b55a5e8-74e6-4241-b323-e360dc8b110a"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2025-249","url":"https://osv.dev/vulnerability/PYSEC-2025-249"}],"summary":"A critical deserialization vulnerability exists in the run-llama/llama_index library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote co"}