Detections
Analytics

SCA: security update for llama-index-readers-obsidian (GHSA-3j8r-jf9w-5cmh)

medium Tenable Self-Hosted Container Security Plugin ID 428314

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A vulnerability in the ObsidianReader class of the run-llama/llama_index repository, specifically in
 version 0.12.27, allows for hardlink-based path traversal. This flaw permits attackers to bypass path
 restrictions and access sensitive system files, such as /etc/passwd, by exploiting hardlinks. The
 vulnerability arises from inadequate handling of hardlinks in the load_data() method, where the security
 checks fail to differentiate between real files and hardlinks. This issue is resolved in version 0.5.2.
 (CVE-2025-6210)

See Also

https://github.com/advisories/GHSA-3j8r-jf9w-5cmh

Plugin Details

Severity: Medium

ID: 428314

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 7/8/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.51

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 3.8

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:N

CVSS Score Source: CVE-2025-6210

CVSS v3

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 5.6

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/7/2025

Vulnerability Publication Date: 7/7/2025

Reference Information

CVE: CVE-2025-6210

cwe: CWE-22