PT-2025-39321 · Unknown · Llama Stack

Published 2025-09-24 · Updated 2025-09-25 · CVE-2025-55178

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Llama Stack versions prior to 0.2.20

Description The software accepts unverified parameters in the resolve ast by type function, which may allow for remote code execution.

Recommendations Update to version 0.2.20 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-55178

GHSA-X75H-M6JJ-6CJ2

Affected Products

Llama Stack

References · 11

• https://osv.dev/vulnerability/GHSA-x75h-m6jj-6cj2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55178 · Security Note
• https://osv.dev/vulnerability/CVE-2025-55178 · Vendor Advisory
• https://github.com/llamastack/llama-stack/pull/3281 · Note
• https://github.com/llamastack/llama-stack/releases/tag/v0.2.20 · Note
• https://github.com/llamastack/llama-stack · Note
• https://github.com/llamastack/llama-stack/commit/efdb5558b8dcab4d141678bfed0a405e2f312b6f · Note
• https://facebook.com/security/advisories/cve-2025-55178 · Note
• https://twitter.com/VulmonFeeds/status/1971071812072083944 · Twitter Post
• https://t.me/CVEtracker/33281 · Telegram Post
• https://twitter.com/CVEnew/status/1970996074971267150 · Twitter Post