CVE-2025-3108Medium· 5.0▾ SunlitLlamaIndex has Incomplete Documentation of Program Execution related to JsonPickleSerializer component
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
0.4% → 0.4%
Incomplete Documentation of Program Execution exists in the run-llama/llama_index library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle module. JsonPickleSerializer prioritizes deserialization using pickle.loads(), which can execute arbitrary code when processing untrusted data. Attackers can exploit this by crafting malicious payloads to achieve full system compromise. The root cause involves the use of an insecure fallback strategy without sufficient input validation or protective safeguards. Version 0.12.41 renames JsonPickleSerializer to PickleSerializer and adds a warning to the docs to only use PickleSerializer to deserialize safe things.
llama-index-core >= 0.11.15, < 0.12.41Upgrade to a patched release:
llama-index-core 0.12.41Connected by shared product, vendor, weakness, or advisory.
CVE-2024-12704High· 7.5LlamaIndex Improper Handling of Exceptional Conditions vulnerability
CVE-2025-7647High· 7.3llama-index-core insecurely handles temporary files
CVE-2025-5302High· 8.6LlamaIndex affected by a Denial of Service (DOS) in JSONReader
CVE-2025-6208Medium· 5.3llama-index-core vulnerable to Uncontrolled Resource Consumption
CVE-2025-5472Medium· 6.5LlamaIndex vulnerable to DoS attack through uncontrolled recursive JSON parsing
CVE-2025-6209High· 7.5LlamaIndex vulnerable to Path Traversal attack through its encode_image function