CVE-2025-6208Medium· 5.3▾ Sunlitllama-index-core vulnerable to Uncontrolled Resource Consumption
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
0.4% → 0.4%
The SimpleDirectoryReader component in llama_index.core version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The vulnerability arises because the user-specified file limit (num_files_limit) is applied after all files in a directory are loaded into memory. This can lead to memory exhaustion and degraded performance, particularly in environments with limited resources. The issue is resolved in version 0.12.41.
llama-index-core < 0.12.41Upgrade to a patched release:
llama-index-core 0.12.41Connected by shared product, vendor, weakness, or advisory.
CVE-2025-3108Medium· 5.0LlamaIndex has Incomplete Documentation of Program Execution related to JsonPickleSerializer component
CVE-2024-12704High· 7.5LlamaIndex Improper Handling of Exceptional Conditions vulnerability
CVE-2025-7647High· 7.3llama-index-core insecurely handles temporary files
CVE-2025-5302High· 8.6LlamaIndex affected by a Denial of Service (DOS) in JSONReader
CVE-2025-5472Medium· 6.5LlamaIndex vulnerable to DoS attack through uncontrolled recursive JSON parsing
CVE-2025-6209High· 7.5LlamaIndex vulnerable to Path Traversal attack through its encode_image function