Safety vulnerability ID: 77992
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Affected versions of the LlamaIndex package are vulnerable to Denial of Service (DoS) due to insufficient recursion depth handling in the JSON parser. The `load_data()` function in the `JSONReader` class fails to protect against deeply nested or circular JSON structures during data processing, allowing unbounded recursion depth.
A remote attacker can exploit this vulnerability by providing a maliciously crafted JSON file with excessively nested objects or arrays, causing a stack overflow and denial of service through RecursionError exceptions.
The vulnerability was fixed by implementing exception handling that catches RecursionError during JSON processing (`except RecursionError: ') and gracefully returns an empty document list instead of crashing the application. The fix also adds a warning message to alert users when recursion limits are exceeded during JSON parsing.
Latest version: 0.14.2
Interface between LLMs and your data
This vulnerability has no description
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application