PYSEC-2026-1571
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/llama-stack/PYSEC-2026-1571.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2026-1571
- Aliases
- Published
- 2026-07-07T16:03:05Z
- Modified
- 2026-07-07T17:46:54Z
- Severity
-
- 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
- Summary
- Llama Stack could potentially allow for remote code execution
- Details
-
Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolve_ast_by_type function which could potentially allow for remote code execution.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2025-55178
- https://github.com/llamastack/llama-stack/pull/3281
- https://github.com/llamastack/llama-stack/commit/efdb5558b8dcab4d141678bfed0a405e2f312b6f
- https://github.com/llamastack/llama-stack
- https://github.com/llamastack/llama-stack/releases/tag/v0.2.20
- https://www.facebook.com/security/advisories/cve-2025-55178
- https://pypi.org/project/llama-stack
- https://github.com/advisories/GHSA-x75h-m6jj-6cj2
Affected packages
PyPI / llama-stack
Package
- Name
- llama-stack
- View open source insights on deps.dev
- Purl
- pkg:pypi/llama-stack
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed0.2.20
Affected versions
0.*
0.0.1a0
0.0.1a1
0.0.1a2
0.0.1a3
0.0.1a4
0.0.1a5
0.0.18
0.0.19
0.0.20
0.0.21
0.0.23
0.0.24
0.0.35
0.0.36
0.0.37
0.0.38
0.0.39
0.0.40
0.0.41
0.0.42
0.0.43
0.0.44
0.0.45
0.0.46
0.0.47
0.0.48
0.0.49
0.0.50
0.0.51.dev0
0.0.51
0.0.52
0.0.53
0.0.54
0.0.55
0.0.56
0.0.57
0.0.58
0.0.59
0.0.60
0.0.61
0.0.62
0.0.63
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.5.1
0.1.6
0.1.7
0.1.8
0.1.9
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.2.5
0.2.6
0.2.7
0.2.8
0.2.9
0.2.10
0.2.10.1
0.2.11
0.2.12
0.2.13
0.2.14
0.2.15
0.2.16
0.2.17
0.2.18
0.2.19