LlamaIndexPYSEC-2026-85
LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir w
High7.8CVE-2024-14021 · Published Jan 12, 2026 · updated May 20, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| llama-index PyPI | < 0.11.7 | 0.11.7 |
Details and references
LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir without validation. An attacker who can provide a crafted persist directory containing a malicious pickle file can trigger arbitrary code execution when the victim loads the index from disk.
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Severity from
- the CVSS score
- Also known as
- CVE-2024-14021
More LlamaIndex advisories
All LlamaIndex| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 12 | LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. The custom_query() logic generates SQL statements from a user-supplied prompt and executes them via vn.run_sql() without CVE-2024-58339High7.5fixed in 0.12.3 | High7.5 | 0.12.3 |
| Feb 2 | llama-index-core vulnerable to Uncontrolled Resource Consumption CVE-2025-6208Medium5.3fixed in 0.12.41 | Medium5.3 | 0.12.41 |
| Oct 132025 | llama-index has Insecure Temporary File CVE-2025-7707High7.1fixed in 0.13.0 | High7.1 | 0.13.0 |
| Sep 272025 | llama-index-core insecurely handles temporary files CVE-2025-7647High7.3fixed in 0.13.0 | High7.3 | 0.13.0 |
| Aug 262025 | LlamaIndex affected by a Denial of Service (DOS) in JSONReader CVE-2025-5302High8.6fixed in 0.12.38 | High8.6 | 0.12.38 |
| Jul 102025 | LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class CVE-2025-6211Medium6.5fixed in 0.12.41 | Medium6.5 | 0.12.41 |