PT-2025-12157 · Run Llama · Llama Index

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-12910

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions run-llama/llama index version latest

Description A Denial of Service (DoS) issue exists due to infinite recursive calls to the get article urls method when a URL variable is controlled to contain the root URL, potentially exhausting system resources and crashing the application. This is caused by a vulnerability in the KnowledgeBaseWebReader class.

Recommendations As a temporary workaround, consider disabling the get article urls method until a patch is available. Restrict access to the KnowledgeBaseWebReader class to minimize the risk of exploitation. Avoid using the URL variable to contain the root URL in the affected API endpoint until the issue is resolved.

Exploit

Fix

DoS

Uncontrolled Recursion

Resource Exhaustion

Weakness Enumeration

CWE-674

CWE-400

Related Identifiers

CVE-2024-12910

GHSA-JVPF-XF32-2W4Q

PYSEC-2025-11

Affected Products

Llama Index

References · 9

• 🔥 https://huntr.com/bounties/27883f22-35ff-49df-aaa5-05031c7d6ad8 · Exploit
• https://github.com/run-llama/llama_index/commit/159ce485a1168100bb219dc1b93133f1121579d9 · Patch
• https://osv.dev/vulnerability/GHSA-jvpf-xf32-2w4q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-12910 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12910 · Security Note
• https://osv.dev/vulnerability/PYSEC-2025-11 · Vendor Advisory
• https://github.com/run-llama/llama_index · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/llama-index/PYSEC-2025-11.yaml · Note
• https://twitter.com/CVEnew/status/1903021680416444925 · Twitter Post