LlamaIndex includes an exec call for `import {cls_name}`

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-45201 · ADVISORY
• run-llama/llama_index#13523 · WEB
• run-llama/llama_index commit bd827c3 · WEB
• pypa/advisory-database · WEB
• run-llama/llama_index · PACKAGE
• run-llama/llama_index · WEB
• pypi.org/project/llama-index-core · PACKAGE
• GitHub Advisory GHSA-fxc2-8m62-m85x · ADVISORY

llama-index のその他の脆弱性

• CVE-2024-58339高 7.5LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the Van…
• CVE-2024-14021高 7.8LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_fr…
• CVE-2025-7707高 7.8The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable i…
• CVE-2025-6211中 6.5A vulnerability in the DocugamiReader class of the run-llama/llama_index repository, up to version 0.12.28, involves the use of MD5 hashing …
• CVE-2025-6209高 7.5A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` func…