Run-llama vulnerabilities
We track 20 vulnerabilities in Run-llama products across 2 products. 20 are rated high or critical, and none are known to be exploited. The most recent was published on January 12, 2026.
Latest Run-llama vulnerabilities
- 7.5 High severity
llama_index: Allocation of Resources Without Limits or Throttling
LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. The custom_query() logic generates SQL statements from a user-supplied prompt an
- 7.8 High severity
llama_index: Deserialization of Untrusted Data
LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_stor
- 7.8 High severity
The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the…
The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leadi
- 7.3 High severity
run-llama/llama_index: Creation of Temporary File With Insecure Permissions
The llama-index-core package, up to version 0.12.44, contains a vulnerability in the `get_cache_dir()` function where a predictable, hardcoded directory path `/tmp/llama_index` is used on Linux systems without proper security controls. This vulnerability allow
- 8.6 High severity
run-llama/llama_index: Uncontrolled Recursion
A denial of service vulnerability exists in the JSONReader component of the run-llama/llama_index repository, specifically in version v0.12.37. The vulnerability is caused by uncontrolled recursion when parsing deeply nested JSON files, which can lead to Pytho
- 7.5 High severity
run-llama/llama_index: Path Traversal: '..filename'
A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` function in `generic_utils.py`. This vulnerability allows an attacker to manipulate the `image_path` input to read arbitrary
- 7.5 High severity
run-llama/llama_index: Improper Restriction of Recursive Entity References in DTDs
An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama_index repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply a malicious Sitemap X
- 7.5 High severity
run-llama/llama_index: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability in the `ObsidianReader` class of the run-llama/llama_index repository, versions 0.12.23 to 0.12.28, allows for arbitrary file read through symbolic links. The `ObsidianReader` fails to resolve symlinks to their real paths and does not validate
- 7.5 High severity
run-llama/llama_index: Incomplete Documentation of Program Execution
A critical deserialization vulnerability exists in the run-llama/llama_index library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle
- 9.8 Critical severity
run-llama/llama_index: Improper Neutralization of Special Elements used in an SQL Command
Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially leading to unauthorized access to data of other users dependi
- 9.8 Critical severity
run-llama/llama_index: Improper Neutralization of Special Elements used in an SQL Command
An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the se
- 7.8 High severity
run-llama/llama_index: Improper Neutralization of Special Elements used in an OS Command
LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the `--files` argument, which is directly passed into `os.system`. An attacker who controls the content of this argument can
- 7.5 High severity
run-llama/llama_index: Uncontrolled Recursion
A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ latest(v0.12.15). The vulnerability arises due to inappropriate secure coding measures, specifically the l
- 7.1 High severity
run-llama/llama_index: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerab
- 9.8 Critical severity
run-llama/llama_index: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitrar
- 7.5 High severity
run-llama/llama_index: Loop with Unreachable Exit Condition
A vulnerability in the LangChainLLM class of the run-llama/llama_index repository, version v0.12.5, allows for a Denial of Service (DoS) attack. The stream_complete method executes the llm using a thread and retrieves the result via the get_response_gen method
- 9.8 Critical severity
run-llama/llama_index: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability exists in the `duckdb_retriever` component of the run-llama/llama_index repository, specifically in the latest version. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an a
- 8.8 High severity
run-llama/llama_index: Improper Control of Generation of Code
A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect to Language Learning Models (LLMs). The vulnerability arises from the improper use of the eval funct
- 9.8 Critical severity
run-llama/llama_index: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execut
- 9.8 Critical severity
run-llama/llama_index: Improper Control of Generation of Code
A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, w