CVE-2025-3108
Llamaindex 0.12.27 – 0.12.41
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2025-3108 is a high-severity Incomplete Documentation of Program Execution (CWE-1112) vulnerability in Llamaindex Llamaindex. Its CVSS base score is 7.5 (High).
Operationally, ranked at the 34th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to CM-2 (Baseline Configuration) and SA-5 (System Documentation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
A critical deserialization vulnerability affects the JsonPickleSerializer component in the run-llama/llama_index library, specifically versions v0.12.27 through v0.12.40. The flaw arises from an insecure fallback to Python's pickle module, where the serializer prioritizes pickle.loads() without validation or safeguards, enabling arbitrary code execution on untrusted input and violating standard Python security practices.
Attackers with the ability to supply malicious serialized data can trigger remote code execution, achieving full system compromise. The reported CVSS 7.5 score reflects a network-accessible vector that requires user interaction and high attack complexity yet yields complete confidentiality, integrity, and availability impact.
A fix addressing the insecure deserialization path is referenced in the project commit at https://github.com/run-llama/llama_index/commit/702e4340623092fac4cf2fe95eb9465034856da3, with additional details available in the associated huntr report. The library's use in LLM indexing workflows makes the component relevant to AI/ML environments, though the EPSS score has remained low with only minor movement between its current value of 0.0161 and peak of 0.0195.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-20156
Vulnerability Data
A critical deserialization vulnerability exists in the run-llama/llama_index library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle module. JsonPickleSerializer prioritizes deserialization using pickle.loads(), which can execute arbitrary…
more
code when processing untrusted data. Attackers can exploit this by crafting malicious payloads to achieve full system compromise. The root cause includes an insecure fallback mechanism, lack of validation or safeguards, misleading design, and violation of Python security guidelines.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 3 hardening rules · 3 OS baselines
V2.3.2V3.1.1V6.1.1V8.1.1
Mitigating Controls (NIST 800-53 r5) AI
Requires administrator documentation describing security functions, mechanisms, and configuration that govern program execution.
Requires documented baseline configuration of the system, which includes mechanisms affecting program execution.
Mandates documented configuration settings that directly control or influence program execution behavior.
Requires developer configuration management including documentation of changes affecting how programs execute.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Configuration baselines and change control directly require complete documentation of execution mechanisms.
Allow-listing and execution restrictions presuppose documented definitions of permitted program behavior.
Secure SDLC practices include documenting runtime controls, though the control's primary focus is development rather than operations documentation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Documented operating procedures directly require complete specification of program execution mechanisms.
Secure development life cycle mandates documentation of execution controls, yet coverage depends on process rigor.
Change management requires documenting changes to execution mechanisms, but does not ensure initial completeness.
Configuration management records execution parameters, but does not guarantee completeness of documentation.