LlamaIndex includes an exec call for `import {cls_name}`

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2024-45201 · ADVISORY
• run-llama/llama_index#13523 · WEB
• run-llama/llama_index commit bd827c3 · WEB
• pypa/advisory-database · WEB
• run-llama/llama_index · PACKAGE
• run-llama/llama_index · WEB
• pypi.org/project/llama-index-core · PACKAGE
• GitHub Advisory GHSA-fxc2-8m62-m85x · ADVISORY

Lỗ hổng khác của llama-index

• CVE-2024-58339CAO 7.5LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the Van…
• CVE-2024-14021CAO 7.8LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_fr…
• CVE-2025-7707CAO 7.8The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable i…
• CVE-2025-6211TRUNG BÌNH 6.5A vulnerability in the DocugamiReader class of the run-llama/llama_index repository, up to version 0.12.28, involves the use of MD5 hashing …
• CVE-2025-6209CAO 7.5A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` func…