MEDIUM5.9

PYSEC-2025-11

Quick fix

PYSEC-2025-11 — llama-index: upgrade to the fixed version with the command below.

pip install --upgrade 'llama-index>=159ce485a1168100bb219dc1b93133f1121579d9'

Details

A vulnerability in the `KnowledgeBaseWebReader` class of the run-llama/llama_index repository, version latest, allows an attacker to cause a Denial of Service (DoS) by controlling a URL variable to contain the root URL. This leads to infinite recursive calls to the `get_article_urls` method, exhausting system resources and potentially crashing the application.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/llama-index

Introduced in: 0Fixed in: 159ce485a1168100bb219dc1b93133f1121579d9

Fixpip install --upgrade 'llama-index>=159ce485a1168100bb219dc1b93133f1121579d9'

References

https://huntr.com/bounties/27883f22-35ff-49df-aaa5-05031c7d6ad8[EVIDENCE]
https://github.com/run-llama/llama_index/commit/159ce485a1168100bb219dc1b93133f1121579d9[FIX]
https://github.com/advisories/GHSA-jvpf-xf32-2w4q[ADVISORY]