Read the docs
TI-2025-02714 Aliases CVE-2025-3108GHSA-m84c-4c34-28gf

Unsafe Deserialization in JsonPickleSerializer Enables Remote Code Execution in run-llama/llama_index

Priority HIGH 66CWE-1112Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

A critical deserialization vulnerability exists in the run-llama/llama_index library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle module. JsonPickleSerializer prioritizes deserialization using pickle.loads(), which can execute arbitrary code when processing untrusted data. Attackers can exploit this by crafting malicious payloads to achieve full system compromise. The root cause includes an insecure fallback mechanism, lack of validation or safeguards, misleading design, and violation of Python security guidelines.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.005 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed run-llama/llama_index (run-llama): v0.12.41llama-index-core (PyPI): 0.12.41

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
run-llamarun-llama/llama_indexbefore v0.12.41v0.12.41Patch availableCNA
—llama-index-core (PyPI)0.11.15 to before 0.12.410.12.41Patch availableGHSA-m84c-4c34-28gf
  • run-llama/llama_index Vendorrun-llama Affected before v0.12.41 Fixed in v0.12.41 Patch available CNA
  • llama-index-core (PyPI) Vendor— Affected 0.11.15 to before 0.12.41 Fixed in 0.12.41 Patch available GHSA-m84c-4c34-28gf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:llamaindex:llamaindex:*:*:*:*:*:*:*:*0.12.27 to before 0.12.41Vulnerablerun-llama
  • cpe:2.3:a:llamaindex:llamaindex:*:*:*:*:*:*:*:* Versions 0.12.27 to before 0.12.41 Vulnerable ·run-llama

Remediation

  • Fix · CNA run-llama/llama_index (run-llama) Fixed in v0.12.41
  • Fix · GHSA-m84c-4c34-28gf llama-index-core (PyPI) Fixed in 0.12.41 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-3108
  2. 2026-10-03 Alias added: GHSA-m84c-4c34-28gf

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2025-01545 SQL Injection in run-llama/llama_index CVSS 3.0CRITICAL 9.8
  • TI-2025-01507 SQL Injection in run-llama/llama_index CVSS 3.0CRITICAL 9.8
  • TI-2024-11960 SQL Injection to RCE in run-llama/llama_index CVSS 3.1CRITICAL 9.8
  • TI-2024-11094 SQL Injection in run-llama/llama_index CVSS 3.0CRITICAL 9.8
  • TI-2024-03068 Command Injection in run-llama/llama_index CVSS 3.0CRITICAL 9.8
  • TI-2024-15754 LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL… CVSS 3.1CRITICAL 9.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences