CVE-2024-12910

Name of the Vulnerable Software and Affected Versions run-llama/llama index version latest

Description A Denial of Service (DoS) issue exists due to infinite recursive calls to the get article urls method when a URL variable is controlled to contain the root URL, potentially exhausting system resources and crashing the application. This is caused by a vulnerability in the KnowledgeBaseWebReader class.

Recommendations As a temporary workaround, consider disabling the get article urls method until a patch is available. Restrict access to the KnowledgeBaseWebReader class to minimize the risk of exploitation. Avoid using the URL variable to contain the root URL in the affected API endpoint until the issue is resolved.