CVE-2024-58339 | High | 7.5 | 2026-01-12 | LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEn… |
CVE-2024-14021 | High | 7.8 | 2026-01-12 | LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_… |
CVE-2025-7707 | High | 7.8 | 2025-10-13 | The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user enviro… |
CVE-2025-6211 | Medium | 6.5 | 2025-07-10 | A vulnerability in the DocugamiReader class of the run-llama/llama_index repository, up to version 0.12.28, involves the use of MD5 hashing to generate IDs for… |
CVE-2025-6209 | High | 7.5 | 2025-07-07 | A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` function in `generic_ut… |
CVE-2025-6210 | Medium | 6.2 | 2025-07-07 | A vulnerability in the ObsidianReader class of the run-llama/llama_index repository, specifically in version 0.12.27, allows for hardlink-based path traversal… |
CVE-2025-5472 | Medium | 6.5 | 2025-07-07 | The JSONReader in run-llama/llama_index versions 0.12.28 is vulnerable to a stack overflow due to uncontrolled recursive JSON parsing. This vulnerability allow… |
CVE-2025-3225 | High | 7.5 | 2025-07-07 | An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama_index repository, specifica… |
CVE-2025-3046 | High | 7.5 | 2025-07-07 | A vulnerability in the `ObsidianReader` class of the run-llama/llama_index repository, versions 0.12.23 to 0.12.28, allows for arbitrary file read through symb… |
CVE-2025-3044 | Medium | 5.3 | 2025-07-07 | A vulnerability in the ArxivReader class of the run-llama/llama_index repository, versions up to v0.12.22.post1, allows for MD5 hash collisions when generating… |
CVE-2025-3108 | High | 7.5 | 2025-07-06 | A critical deserialization vulnerability exists in the run-llama/llama_index library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.1… |
CVE-2025-1793 | Critical | 9.8 | 2025-06-05 | Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to rea… |
CVE-2025-1750 | Critical | 9.8 | 2025-06-02 | An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attac… |
CVE-2025-1753 | High | 7.8 | 2025-05-28 | LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the `--files` argument… |
CVE-2025-1752 | High | 7.5 | 2025-05-10 | A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ lates… |
CVE-2024-12911 | High | 7.1 | 2025-03-20 | A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository allows for SQL injection via prompt… |
CVE-2024-12910 | Medium | 5.9 | 2025-03-20 | A vulnerability in the `KnowledgeBaseWebReader` class of the run-llama/llama_index repository, version latest, allows an attacker to cause a Denial of Service… |
CVE-2024-12909 | Critical | 9.8 | 2025-03-20 | A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for SQL injection in the `run_sql_query` fu… |
CVE-2024-12704 | High | 7.5 | 2025-03-20 | A vulnerability in the LangChainLLM class of the run-llama/llama_index repository, version v0.12.5, allows for a Denial of Service (DoS) attack. The stream_com… |
CVE-2024-11958 | Critical | 9.8 | 2025-03-20 | A SQL injection vulnerability exists in the `duckdb_retriever` component of the run-llama/llama_index repository, specifically in the latest version. The vulne… |
CVE-2024-45201 | High | 8.8 | 2024-08-22 | An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}. |
CVE-2024-4181 | High | 8.8 | 2024-05-16 | A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect… |
CVE-2024-3271 | Critical | 9.8 | 2024-04-16 | A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended… |
CVE-2024-23751 | Critical | 9.8 | 2024-01-22 | LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetri… |