CVE-2025-3225
XML Entity Expansion vulnerability in run-llama/llama_index
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
XML Entity Expansion vulnerability in run-llama/llama_index
An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama_index repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply a malicious Sitemap XML, leading to a Denial of Service (DoS) by exhausting system memory and potentially causing a system crash. The issue is resolved in version v0.12.29.
Reserved 2025-04-03 | Published 2025-07-07 | Updated 2025-07-07 | Assigner @huntr_aiCWE-776 Improper Restriction of Recursive Entity References in DTDs
huntr.com/bounties/e33c0699-e9a2-49aa-837b-5363205637a2
github.com/...ommit/4f6ee062b19212106a2632af9c9521fc7f0a3584
Support options
