Advisoriesby Ibis
LlamaIndex security advisories
27 advisories · 2 critical or high in 12 months · latest Feb 2
27 advisories
llama-index-core vulnerable to Uncontrolled Resource ConsumptionCVE-2025-6208fixed in 0.12.41LlamaIndex: unsafe deserializationCVE-2024-14021fixed in 0.11.7LlamaIndex: resource exhaustionCVE-2024-58339fixed in 0.12.3llama-index has Insecure Temporary FileCVE-2025-7707fixed in 0.13.0llama-index-core insecurely handles temporary filesCVE-2025-7647fixed in 0.13.0LlamaIndex affected by a Denial of Service (DOS) in JSONReaderCVE-2025-5302fixed in 0.12.38LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader classCVE-2025-6211fixed in 0.12.41LlamaIndex vulnerable to Path Traversal attack through its encode_image functionCVE-2025-6209fixed in 0.12.41LlamaIndex vulnerable to DoS attack through uncontrolled recursive JSON parsingCVE-2025-5472fixed in 0.12.38LlamaIndex: path traversalCVE-2025-6210fixed in 0.5.2LlamaIndex: denial of serviceCVE-2025-3225fixed in 0.12.29A vulnerability in the ArxivReader class of the run-llama/llama_index repositoryCVE-2025-3044fixed in 0.12.28LlamaIndex: arbitrary file readCVE-2025-3046fixed in 0.12.28LlamaIndex has Incomplete Documentation of Program Execution related to JsonPickleSerializer componentCVE-2025-3108fixed in 0.12.41llama_index vulnerable to SQL InjectionCVE-2025-1793fixed in 0.12.28LlamaIndex: SQL injectionCVE-2025-1750fixed in 0.12.21LlamaIndex: command injectionCVE-2025-1753no fix yetLlamaIndex Vulnerable to Denial of Service (DoS)CVE-2025-1752fixed in 0.12.21LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure PermissionsCVE-2024-12911fixed in 0.12.3LlamaIndex Uncontrolled Resource Consumption vulnerabilityCVE-2024-12910fixed in 0.12.9LlamaIndex Improper Handling of Exceptional Conditions vulnerabilityCVE-2024-12704fixed in 0.12.6LlamaIndex includes an exec call for `import {cls_name}`CVE-2024-45201fixed in 0.10.38RunGptLLM class in LlamaIndex has a command injectionCVE-2024-4181fixed in 0.10.13llama-index-core Command Injection vulnerabilityCVE-2024-3271fixed in 0.10.24llama-index-core Prompt Injection vulnerability leading to Arbitrary Code ExecutionCVE-2024-3098fixed in 0.10.24SQL injection in llama-indexCVE-2024-23751no fix yetllama-index vulnerable to arbitrary code executionCVE-2023-39662fixed in 0.9.14About LlamaIndex
The framework for agents over your data.
Packages watched: llama-index (PyPI), llama-index-core (PyPI).
LlamaIndex elsewhere on Ibis: Funding · Paydays · Releases · Repos