HIGH7.5
PYSEC-2025-250
Quick fix
PYSEC-2025-250 — llama-index: upgrade to the fixed version with the command below.
pip install --upgrade 'llama-index>=0.12.29'Details
An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama_index repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply a malicious Sitemap XML, leading to a Denial of Service (DoS) by exhausting system memory and potentially causing a system crash. The issue is resolved in version v0.12.29.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/llama-index
Introduced in:
0.12.21Fixed in: 0.12.29Fix
pip install --upgrade 'llama-index>=0.12.29'