Advisoriesby IbisLlamaIndexPYSEC-2025-247
A vulnerability in the ArxivReader class of the run-llama/llama_index repository
Fix: upgrade to 0.12.28 or later
A vulnerability in the ArxivReader class of the run-llama/llama_index repository, versions up to v0.12.22.post1, allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each other, preventing some papers from being processed for AI model training. The issue is resolved in version 0.12.28.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| llama-index PyPI | < 0.12.28 | 0.12.28 |
Details and references
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Severity from
- the CVSS score
- Also known as
- CVE-2025-3044, GHSA-p7j4-jwjf-5x9w, PYSEC-2026-1569
More LlamaIndex advisories
All LlamaIndex
LlamaIndex vulnerable to Path Traversal attack through its encode_image functionCVE-2025-6209fixed in 0.12.41LlamaIndex vulnerable to DoS attack through uncontrolled recursive JSON parsingCVE-2025-5472fixed in 0.12.38LlamaIndex: path traversalCVE-2025-6210fixed in 0.5.2LlamaIndex: denial of serviceCVE-2025-3225fixed in 0.12.29LlamaIndex: arbitrary file readCVE-2025-3046fixed in 0.12.28LlamaIndex has Incomplete Documentation of Program Execution related to JsonPickleSerializer componentCVE-2025-3108fixed in 0.12.41