fkie_nvd - fkie_cve-2025-55178

fkie_cve-2025-55178

Vulnerability from fkie_nvd

Published

2025-09-24 19:15

Modified

2025-09-26 14:32

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Summary

Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolve_ast_by_type function which could potentially allow for remote code execution.

References

	URL	Tags
	cve-assign@fb.com	https://github.com/llamastack/llama-stack/pull/3281
	cve-assign@fb.com	https://github.com/llamastack/llama-stack/releases/tag/v0.2.20
	cve-assign@fb.com	https://www.facebook.com/security/advisories/cve-2025-55178

Impacted products

	Vendor	Product	Version

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolve_ast_by_type function which could potentially allow for remote code execution."
    },
    {
      "lang": "es",
      "value": "Llama Stack anterior a la versi\u00f3n v0.2.20 aceptaba par\u00e1metros no verificados en la funci\u00f3n resolve_ast_by_type, lo que potencialmente podr\u00eda permitir la ejecuci\u00f3n remota de c\u00f3digo."
    }
  ],
  "id": "CVE-2025-55178",
  "lastModified": "2025-09-26T14:32:53.583",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-09-24T19:15:36.467",
  "references": [
    {
      "source": "cve-assign@fb.com",
      "url": "https://github.com/llamastack/llama-stack/pull/3281"
    },
    {
      "source": "cve-assign@fb.com",
      "url": "https://github.com/llamastack/llama-stack/releases/tag/v0.2.20"
    },
    {
      "source": "cve-assign@fb.com",
      "url": "https://www.facebook.com/security/advisories/cve-2025-55178"
    }
  ],
  "sourceIdentifier": "cve-assign@fb.com",
  "vulnStatus": "Awaiting Analysis"
}

CVE-2025-55178 (GCVE-0-2025-55178)

Vulnerability from cvelistv5

Published

2025-09-24 18:31

Modified

2025-09-24 18:50

Severity ?

5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Summary

Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolve_ast_by_type function which could potentially allow for remote code execution.

References

URL

Tags

	https://www.facebook.com/security/advisories/cve-2025-55178	x_refsource_CONFIRM
	https://github.com/llamastack/llama-stack/pull/3281	x_refsource_CONFIRM
	https://github.com/llamastack/llama-stack/releases/tag/v0.2.20	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Meta Platforms, Inc	Llama Stack	Version: 0.0.0 ≤

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.3,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-55178",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-24T18:49:33.013687Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-24T18:50:01.680Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Llama Stack",
          "vendor": "Meta Platforms, Inc",
          "versions": [
            {
              "lessThan": "0.2.20",
              "status": "affected",
              "version": "0.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "dateAssigned": "2025-09-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Llama Stack prior to version v0.2.20 accepted unverified parameters in the resolve_ast_by_type function which could potentially allow for remote code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-24T18:31:28.309Z",
        "orgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
        "shortName": "Meta"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.facebook.com/security/advisories/cve-2025-55178"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/llamastack/llama-stack/pull/3281"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/llamastack/llama-stack/releases/tag/v0.2.20"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4fc57720-52fe-4431-a0fb-3d2c8747b827",
    "assignerShortName": "Meta",
    "cveId": "CVE-2025-55178",
    "datePublished": "2025-09-24T18:31:28.309Z",
    "dateReserved": "2025-08-08T18:21:47.119Z",
    "dateUpdated": "2025-09-24T18:50:01.680Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.