Deserialization Vulnerability in JsonPickleSerializer of run-llama's Library
CVE-2025-3108
Key Information:
- Vendor
Run-llama
- Status
- Vendor
- CVE Published:
- 6 July 2025
Badges
What is CVE-2025-3108?
CVE-2025-3108 is a critical vulnerability found in the JsonPickleSerializer component of the run-llama open-source library, specifically affecting versions v0.12.27 through v0.12.40. This issue stems from an insecure deserialization mechanism that relies on Python's pickle module without adequate validation or safeguards. The vulnerability allows attackers to execute arbitrary code by crafting malicious payloads, exposing systems to significant risks, including full system compromise. The design flaw in JsonPickleSerializer’s fallback to pickle.loads() signifies a lack of adherence to Python security guidelines, making it particularly dangerous when processing untrusted data. Organizations employing the run-llama library should be aware that this vulnerability could severely impact their applications, leading to unauthorized access and control over their systems.
Potential impact of CVE-2025-3108
-
Remote Code Execution: The primary concern associated with CVE-2025-3108 is the potential for remote code execution. This allows attackers to run arbitrary commands on the target system, potentially leading to complete takeover of the affected environment.
-
Full System Compromise: Exploitation of this vulnerability could result in full system compromise, granting attackers the ability to manipulate data, deploy malware, or disrupt services, thereby affecting operational continuity.
-
Data Breaches: Due to the nature of the vulnerability, organizations are also at risk of significant data breaches, where sensitive information could be accessed and extracted by unauthorized parties, leading to reputational damage and financial losses.
Affected Version(s)
run-llama/llama_index < unspecified
News Articles
SnykCVE-2025-3108Deserialization of Untrusted Data in llama-index-core | CVE-2025-3108 | Snyk
Low severity (2.1) Deserialization of Untrusted Data in llama-index-core | CVE-2025-3108
4 days ago
wiz.ioCVE-2025-3108CVE-2025-3108 Impact, Exploitability, and Mitigation Steps | Wiz
Understand the critical aspects of CVE-2025-3108 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.
5 days ago
SnykCVE-2025-3108Deserialization of Untrusted Data in llama-index | CVE-2025-3108 | Snyk
Low severity (2.1) Deserialization of Untrusted Data in llama-index | CVE-2025-3108
6 days ago