Llamaindex vulnerabilities
We track 18 vulnerabilities in Llamaindex products. 18 are rated high or critical, and none are known to be exploited. The most recent was published on January 12, 2026.
Latest Llamaindex vulnerabilities
- 7.5 High severity
llama_index: Allocation of Resources Without Limits or Throttling
LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. The custom_query() logic generates SQL statements from a user-supplied prompt an
- 7.8 High severity
llama_index: Deserialization of Untrusted Data
LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_stor
- 7.8 High severity
The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the…
The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leadi
- 7.5 High severity
run-llama/llama_index: Path Traversal: '..filename'
A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` function in `generic_utils.py`. This vulnerability allows an attacker to manipulate the `image_path` input to read arbitrary
- 7.5 High severity
run-llama/llama_index: Improper Restriction of Recursive Entity References in DTDs
An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama_index repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply a malicious Sitemap X
- 7.5 High severity
run-llama/llama_index: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in the `ObsidianReader` class of the run-llama/llama_index repository, versions 0.12.23 to 0.12.28, allows for arbitrary file read through symbolic links. The `ObsidianReader` fails to resolve symlinks to their real paths and does not validate
- 7.5 High severity
run-llama/llama_index: Incomplete Documentation of Program Execution
A critical deserialization vulnerability exists in the run-llama/llama_index library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle
- 9.8 Critical severity
run-llama/llama_index: Improper Neutralization of Special Elements used in an SQL Command
Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially leading to unauthorized access to data of other users dependi
- 9.8 Critical severity
run-llama/llama_index: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the se
- 7.8 High severity
run-llama/llama_index: Improper Neutralization of Special Elements used in an OS Command
LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the `--files` argument, which is directly passed into `os.system`. An attacker who controls the content of this argument can
- 7.5 High severity
run-llama/llama_index: Uncontrolled Recursion
A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ latest(v0.12.15). The vulnerability arises due to inappropriate secure coding measures, specifically the l
- 7.1 High severity
run-llama/llama_index: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerab
- 9.8 Critical severity
run-llama/llama_index: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitrar
- 7.5 High severity
run-llama/llama_index: Loop with Unreachable Exit Condition
A vulnerability in the LangChainLLM class of the run-llama/llama_index repository, version v0.12.5, allows for a Denial of Service (DoS) attack. The stream_complete method executes the llm using a thread and retrieves the result via the get_response_gen method
- 9.8 Critical severity
run-llama/llama_index: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in the `duckdb_retriever` component of the run-llama/llama_index repository, specifically in the latest version. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an a
- 8.8 High severity
run-llama/llama_index: Improper Control of Generation of Code
A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect to Language Learning Models (LLMs). The vulnerability arises from the improper use of the eval funct
- 9.8 Critical severity
run-llama/llama_index: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execut
- 9.8 Critical severity
Llamaindex: Improper Neutralization of Special Elements used in an SQL Command
LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to del