CVE-2025-55178
MEDIUMLlama Stack < 0.2.20 - Remote Code Execution via Unverified Parameters in resolve_ast_by_type
Title source: llmDescription
Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolve_ast_by_type function which could potentially allow for remote code execution.
References (3)
Core 3
Core References
Vendor Advisory x_refsource_confirm
https://www.facebook.com/security/advisories/cve-2025-55178
Issue Tracking x_refsource_confirm
https://github.com/llamastack/llama-stack/pull/3281
Release Notes x_refsource_confirm
https://github.com/llamastack/llama-stack/releases/tag/v0.2.20
Scores
CVSS v3
5.3
EPSS
0.0020
EPSS Percentile
42.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
Status
published
Products (2)
Meta Platforms, Inc/Llama Stack
0.0.0 - 0.2.20
pypi/llama-stack
0 - 0.2.20PyPI
Published
Sep 24, 2025
Tracked Since
Feb 18, 2026