{"id":"CVE-2025-55178","aliases":["GHSA-x75h-m6jj-6cj2","PYSEC-2026-1571"],"title":"Llama Stack could potentially allow for remote code execution","summary":"Llama Stack could potentially allow for remote code execution","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","vendor":"llama-stack","product":"llama-stack","ecosystem":"pip","affected":["llama-stack < 0.2.20"],"patched":["llama-stack 0.2.20"],"published":"2025-09-24","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-x75h-m6jj-6cj2","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55178"},{"url":"https://github.com/llamastack/llama-stack/pull/3281"},{"url":"https://github.com/llamastack/llama-stack/commit/efdb5558b8dcab4d141678bfed0a405e2f312b6f"},{"url":"https://github.com/llamastack/llama-stack"},{"url":"https://github.com/llamastack/llama-stack/releases/tag/v0.2.20"},{"url":"https://www.facebook.com/security/advisories/cve-2025-55178"}],"tags":["osv","pip"],"epss":0.00504,"epssPercentile":0.41922,"ingestedAt":"2026-07-08T18:25:54.132Z","slug":"CVE-2025-55178","body":"## Overview\n\nLlama Stack prior to version v0.2.20 accepted unverified parameters in the resolve_ast_by_type function which could potentially allow for remote code execution.\n\n## Affected packages\n\n- `llama-stack < 0.2.20`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `llama-stack 0.2.20`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}