Detections
Analytics

SCA: security update for llama-index-core (GHSA-7753-xrfw-ch36)

high Tenable Cloud Security Plugin ID 435099

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A denial of service vulnerability exists in the JSONReader component of the run-llama/llama_index
 repository, specifically in version v0.12.37. The vulnerability is caused by uncontrolled recursion when
 parsing deeply nested JSON files, which can lead to Python hitting its maximum recursion depth limit. This
 results in high resource consumption and potential crashes of the Python process. The issue is resolved in
 version 0.12.38. (CVE-2025-5302)

See Also

https://github.com/advisories/GHSA-7753-xrfw-ch36

Plugin Details

Severity: High

ID: 435099

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 8/26/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.9

Percentile: 52.46

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:C

CVSS Score Source: CVE-2025-5302

CVSS v3

Risk Factor: High

Base Score: 8.6

Temporal Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/26/2025

Vulnerability Publication Date: 8/25/2025

Reference Information

CVE: CVE-2025-5302

cwe: CWE-674