LlamaIndexPYSEC-2026-86
LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. The custom_query() logic generates SQL statements from a user-supplied prompt and executes them via vn.run_sql() without
High7.5CVE-2024-58339 · Published Jan 12, 2026 · updated May 20, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| llama-index PyPI | < 0.12.3 | 0.12.3 |
Details and references
LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. The custom_query() logic generates SQL statements from a user-supplied prompt and executes them via vn.run_sql() without enforcing query execution limits In downstream deployments where untrusted users can supply prompts, an attacker can trigger expensive or unbounded SQL operations that exhaust CPU or memory resources, resulting in a denial-of-service condition. The vulnerable execution path occurs in llama_index/packs/vanna/base.py within custom_query().
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- the CVSS score
- Also known as
- CVE-2024-58339
More LlamaIndex advisories
All LlamaIndex| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jan 12 | LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir w CVE-2024-14021High7.8fixed in 0.11.7 | High7.8 | 0.11.7 |
| Feb 2 | llama-index-core vulnerable to Uncontrolled Resource Consumption CVE-2025-6208Medium5.3fixed in 0.12.41 | Medium5.3 | 0.12.41 |
| Oct 132025 | llama-index has Insecure Temporary File CVE-2025-7707High7.1fixed in 0.13.0 | High7.1 | 0.13.0 |
| Sep 272025 | llama-index-core insecurely handles temporary files CVE-2025-7647High7.3fixed in 0.13.0 | High7.3 | 0.13.0 |
| Aug 262025 | LlamaIndex affected by a Denial of Service (DOS) in JSONReader CVE-2025-5302High8.6fixed in 0.12.38 | High8.6 | 0.12.38 |
| Jul 102025 | LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class CVE-2025-6211Medium6.5fixed in 0.12.41 | Medium6.5 | 0.12.41 |