CVE-2025-3225: Llamaindex

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama_index repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply a malicious Sitemap XML, leading to a Denial of Service (DoS) by exhausting system memory and potentially causing a system crash. The issue is resolved in version v0.12.29.

Affected products

• Llamaindex Llamaindex: from 0.12.21, before 0.12.29 (fixed in 0.12.29)

Published 2025-07-07. Last modified 2026-06-17.