https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-58339.htmlhttps://patchthecve.com/cve/CVE-2024-58339.htmlTue, 14 Jul 2026 23:17:18 +0000HIGH 7.5: LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. The custom_query() logic generates SQL statements from a user-supplied prompt and executes them via vn.run_sql() withouthttps://patchthecve.com/cve/CVE-2024-14021.htmlhttps://patchthecve.com/cve/CVE-2024-14021.htmlTue, 14 Jul 2026 23:17:13 +0000HIGH 7.8: LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir whttps://patchthecve.com/cve/CVE-2025-7707.htmlhttps://patchthecve.com/cve/CVE-2025-7707.htmlThu, 08 Oct 2026 12:10:00 +0000HIGH 7.8: The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt NLTK data files, leading to potential denial of service, data https://patchthecve.com/cve/CVE-2025-6211.htmlhttps://patchthecve.com/cve/CVE-2025-6211.htmlWed, 17 Jun 2026 10:01:23 +0000MEDIUM 6.5: A vulnerability in the DocugamiReader class of the run-llama/llama_index repository, up to version 0.12.28, involves the use of MD5 hashing to generate IDs for document chunks. This approach leads to hash collisions when structurally distinct chunks contain identical text, resulting in one chunk ovehttps://patchthecve.com/cve/CVE-2025-6209.htmlhttps://patchthecve.com/cve/CVE-2025-6209.htmlWed, 17 Jun 2026 10:01:23 +0000HIGH 7.5: A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` function in `generic_utils.py`. This vulnerability allows an attacker to manipulate the `image_path` input to read arbitrary files on the server, including sensitivhttps://patchthecve.com/cve/CVE-2025-6210.htmlhttps://patchthecve.com/cve/CVE-2025-6210.htmlSun, 18 Oct 2026 21:10:00 +0000MEDIUM 6.2: A vulnerability in the ObsidianReader class of the run-llama/llama_index repository, specifically in version 0.12.27, allows for hardlink-based path traversal. This flaw permits attackers to bypass path restrictions and access sensitive system files, such as /etc/passwd, by exploiting hardlinks. Thehttps://patchthecve.com/cve/CVE-2025-5472.htmlhttps://patchthecve.com/cve/CVE-2025-5472.htmlWed, 17 Jun 2026 09:47:59 +0000MEDIUM 6.5: The JSONReader in run-llama/llama_index versions 0.12.28 is vulnerable to a stack overflow due to uncontrolled recursive JSON parsing. This vulnerability allows attackers to trigger a Denial of Service (DoS) by submitting deeply nested JSON structures, leading to a RecursionError and crashing applichttps://patchthecve.com/cve/CVE-2025-3225.htmlhttps://patchthecve.com/cve/CVE-2025-3225.htmlWed, 17 Jun 2026 09:19:28 +0000HIGH 7.5: An XML Entity Expansion vulnerability, also known as a 'billion laughs' attack, exists in the sitemap parser of the run-llama/llama_index repository, specifically affecting version v0.12.21. This vulnerability allows an attacker to supply a malicious Sitemap XML, leading to a Denial of Service (DoS)https://patchthecve.com/cve/CVE-2025-3046.htmlhttps://patchthecve.com/cve/CVE-2025-3046.htmlWed, 17 Jun 2026 09:19:05 +0000HIGH 7.5: A vulnerability in the `ObsidianReader` class of the run-llama/llama_index repository, versions 0.12.23 to 0.12.28, allows for arbitrary file read through symbolic links. The `ObsidianReader` fails to resolve symlinks to their real paths and does not validate whether the resolved paths lie within thhttps://patchthecve.com/cve/CVE-2025-3044.htmlhttps://patchthecve.com/cve/CVE-2025-3044.htmlWed, 17 Jun 2026 09:19:05 +0000MEDIUM 5.3: A vulnerability in the ArxivReader class of the run-llama/llama_index repository, versions up to v0.12.22.post1, allows for MD5 hash collisions when generating filenames for downloaded papers. This can lead to data loss as papers with identical titles but different contents may overwrite each other,https://patchthecve.com/cve/CVE-2025-3108.htmlhttps://patchthecve.com/cve/CVE-2025-3108.htmlWed, 17 Jun 2026 09:19:12 +0000HIGH 7.5: A critical deserialization vulnerability exists in the run-llama/llama_index library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle module. JsonPickleSerializer prioritizeshttps://patchthecve.com/cve/CVE-2025-1793.htmlhttps://patchthecve.com/cve/CVE-2025-1793.htmlWed, 17 Jun 2026 08:39:47 +0000CRITICAL 9.8: Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially leading to unauthorized access to data of other users depending on the usage of the llama-index librahttps://patchthecve.com/cve/CVE-2025-1750.htmlhttps://patchthecve.com/cve/CVE-2025-1750.htmlWed, 17 Jun 2026 08:39:42 +0000CRITICAL 9.8: An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attacker to manipulate the ref_doc_id parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote codehttps://patchthecve.com/cve/CVE-2025-1753.htmlhttps://patchthecve.com/cve/CVE-2025-1753.htmlWed, 17 Jun 2026 08:39:43 +0000HIGH 7.8: LLama-Index CLI version v0.12.20 contains an OS command injection vulnerability. The vulnerability arises from the improper handling of the `--files` argument, which is directly passed into `os.system`. An attacker who controls the content of this argument can inject and execute arbitrary shell commhttps://patchthecve.com/cve/CVE-2025-1752.htmlhttps://patchthecve.com/cve/CVE-2025-1752.htmlWed, 17 Jun 2026 08:39:42 +0000HIGH 7.5: A Denial of Service (DoS) vulnerability has been identified in the KnowledgeBaseWebReader class of the run-llama/llama_index project, affecting version ~ latest(v0.12.15). The vulnerability arises due to inappropriate secure coding measures, specifically the lack of proper implementation of the max_https://patchthecve.com/cve/CVE-2024-12911.htmlhttps://patchthecve.com/cve/CVE-2024-12911.htmlWed, 17 Jun 2026 07:00:44 +0000HIGH 7.1: A vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository allows for SQL injection via prompt injection. This can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerability affects the latest version and is https://patchthecve.com/cve/CVE-2024-12910.htmlhttps://patchthecve.com/cve/CVE-2024-12910.htmlWed, 17 Jun 2026 07:00:44 +0000MEDIUM 5.9: A vulnerability in the `KnowledgeBaseWebReader` class of the run-llama/llama_index repository, version latest, allows an attacker to cause a Denial of Service (DoS) by controlling a URL variable to contain the root URL. This leads to infinite recursive calls to the `get_article_urls` method, exhausthttps://patchthecve.com/cve/CVE-2024-12909.htmlhttps://patchthecve.com/cve/CVE-2024-12909.htmlWed, 17 Jun 2026 07:00:44 +0000CRITICAL 9.8: A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for SQL injection in the `run_sql_query` function of the `database_agent`. This vulnerability can be exploited by an attacker to inject arbitrary SQL queries, leading to remote code exhttps://patchthecve.com/cve/CVE-2024-12704.htmlhttps://patchthecve.com/cve/CVE-2024-12704.htmlWed, 17 Jun 2026 07:00:18 +0000HIGH 7.5: A vulnerability in the LangChainLLM class of the run-llama/llama_index repository, version v0.12.5, allows for a Denial of Service (DoS) attack. The stream_complete method executes the llm using a thread and retrieves the result via the get_response_gen method of the StreamingGeneratorCallbackHandlehttps://patchthecve.com/cve/CVE-2024-11958.htmlhttps://patchthecve.com/cve/CVE-2024-11958.htmlWed, 17 Jun 2026 06:58:46 +0000CRITICAL 9.8: A SQL injection vulnerability exists in the `duckdb_retriever` component of the run-llama/llama_index repository, specifically in the latest version. The vulnerability arises from the construction of SQL queries without using prepared statements, allowing an attacker to inject arbitrary SQL code. Thhttps://patchthecve.com/cve/CVE-2024-45201.htmlhttps://patchthecve.com/cve/CVE-2024-45201.htmlWed, 17 Jun 2026 07:53:47 +0000HIGH 8.8: An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}.https://patchthecve.com/cve/CVE-2024-4181.htmlhttps://patchthecve.com/cve/CVE-2024-4181.htmlWed, 17 Jun 2026 08:01:16 +0000HIGH 8.8: A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect to Language Learning Models (LLMs). The vulnerability arises from the improper use of the eval function, allowing a malicious or compromisedhttps://patchthecve.com/cve/CVE-2024-3271.htmlhttps://patchthecve.com/cve/CVE-2024-3271.htmlWed, 17 Jun 2026 07:43:41 +0000CRITICAL 9.8: A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. This is achieved by crhttps://patchthecve.com/cve/CVE-2024-23751.htmlhttps://patchthecve.com/cve/CVE-2024-23751.htmlWed, 17 Jun 2026 07:13:31 +0000CRITICAL 9.8: LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Dro