Search for packages
| purl | pkg:pypi/llama-index@0.4.4.post2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-44bs-9zvm-mbby
Aliases: CVE-2023-39662 GHSA-2xxc-73fv-36f7 PYSEC-2023-148 |
An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function. |
Affected by 5 other vulnerabilities. Affected by 5 other vulnerabilities. |
|
VCID-87xp-zjvx-h3gz
Aliases: CVE-2024-14021 PYSEC-2026-85 |
LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir without validation. An attacker who can provide a crafted persist directory containing a malicious pickle file can trigger arbitrary code execution when the victim loads the index from disk. |
Affected by 2 other vulnerabilities. |
|
VCID-9wyc-qhrw-jugv
Aliases: CVE-2024-58339 PYSEC-2026-86 |
LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. The custom_query() logic generates SQL statements from a user-supplied prompt and executes them via vn.run_sql() without enforcing query execution limits In downstream deployments where untrusted users can supply prompts, an attacker can trigger expensive or unbounded SQL operations that exhaust CPU or memory resources, resulting in a denial-of-service condition. The vulnerable execution path occurs in llama_index/packs/vanna/base.py within custom_query(). |
Affected by 1 other vulnerability. |
|
VCID-pwtm-tefd-kkc5
Aliases: CVE-2024-23751 GHSA-2jxw-4hm4-6w87 PYSEC-2024-12 |
LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Drop the Students table" within English language input. |
Affected by 5 other vulnerabilities. |
|
VCID-q77g-pdfy-rfdc
Aliases: CVE-2024-45201 GHSA-fxc2-8m62-m85x PYSEC-2024-192 |
An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}. |
Affected by 3 other vulnerabilities. |
|
VCID-s83c-jsfw-nfg5
Aliases: CVE-2024-12910 PYSEC-2025-11 |
A vulnerability in the `KnowledgeBaseWebReader` class of the run-llama/llama_index repository, version latest, allows an attacker to cause a Denial of Service (DoS) by controlling a URL variable to contain the root URL. This leads to infinite recursive calls to the `get_article_urls` method, exhausting system resources and potentially crashing the application. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||