repository icon
run-llama / llama_index Project repository

LlamaIndex is a data framework for your LLM applications

Submit a report

FIRST INTERACTION

WITHIN12 DAYS

REVIEW

WITHIN12 DAYS

FIX

WITHIN90 DAYS

SQL Injection in llama-index-vector-stores-db2 and llama-index-vector-stores-cou...
ar03
duplicate
Critical
Arbitrary code execution via unsanitized llama_hub_url in download_llama_module(...
rishavkumarthapa01-sketch
duplicate
High
Sandbox Escape via Nested Import Bypass and Missing __builtins__ Restriction in...
phenggeler
duplicate
None
Arbitrary Code Execution via Pickle Deserialization in EmbeddedTablesUnstructure...
manja316
duplicate
Critical
Unsafe pickle.load() in BGEM3Index.load_from_disk() Enables RCE via Malicious In...
odysseypro25-project
self closed
Unsafe pickle deserialization in EmbeddedTablesUnstructuredRetrieverPack leads t...
narrator3333-hash
duplicate
Critical
SQL Injection via Unparameterized f-string Query Construction in Multiple Vector...
elucidator-hky
duplicate
High
Server-Side Request Forgery (SSRF) in Core Schema and Multiple Web Readers Due t...
elucidator-hky
self closed
Arbitrary code execution via unsafe pickle.load() and torch.load() in multiple L...
elucidator-hky
self closed
LlamaIndex: exec() Code Execution with Bypassable Sandbox in Evaporate Extractor
iamveene
self closed
LlamaIndex: SSRF via SimpleWebPageReader -- No URL Validation or Private IP Bloc...
iamveene
self closed
LlamaIndex: RAG Indirect Prompt Injection via Unsanitized Document Context Inser...
iamveene
self closed
Unprotected pickle.load() in 5 Locations Across 4 LlamaIndex Integration Package...
iamveene
self closed
Sandbox escape in exec_utils allows arbitrary command execution
vnykmshr
duplicate
Critical
Sandbox Bypass in safe_exec / safe_eval leading to Remote Code Execution (RCE) v...
amitzalman
duplicate
Critical
Sandbox Escape via AST Bypass and __builtins__ Injection in safe_exec leads to R...
uchiha100x
self closed
SQL Injection via MetadataFilter key/value in 7 Vector Store query() Paths (Mari...
d3banjan
self closed
NoSQL Injection in AzureCosmosDBNoSqlVectorSearch `delete()` and `_query()` Meth...
hiyokosauna37
self closed
Sandbox Escape in Evaporate Extractor via chr()+operator.attrgetter — Remote Cod...
apeiria-zero
duplicate
Critical
AST Sandbox Bypass via eval/exec string literals in _validate_generated_code() l...
erc840902
duplicate
Critical
Unsafe pickle.load() in SimpleObjectNodeMapping.from_persist_dir() enables arbit...
sinhsinhan
duplicate
Critical
LlamaIndex SSRF via Unvalidated Image URL Fetching in LanceDB Integration - Acce...
avienma007
duplicate
Critical
Unsafe Pickle Deserialization in Object Node Mapping Achieves RCE
jeremysommerfeld8910-cpu
duplicate
High
Sandbox Escape via operator.attrgetter in Evaporate Extractor Achieves RCE
jeremysommerfeld8910-cpu
duplicate
Critical
Sandbox Bypass in "safe_exec/safe_eval" Leads to Remote Code Execution
nakosec
duplicate
Critical
SSRF via Unvalidated URL in `LanceDBRetriever` Multimodal Query Functions (`quer...
soze-ki
duplicate
High
PandasQueryEngine Sandbox Escape via pd.io.common.os Module Attribute Traversal
wernerina
duplicate
Critical
Server-Side Request Forgery (SSRF) via Unvalidated URL in SimpleWebPageReader
invisiblemonsters
duplicate
High
Insecure Deserialization in SimpleObjectNodeMapping.from_persist_dir()
loris4py
duplicate
Critical
SQL Injection in Alibaba Cloud MySQL Vector Store via Unsanitized Metadata Filte...
mehmedbesim
duplicate
Critical
Server-Side Request Forgery (SSRF) in Multiple Web Reader Components
galanzi2580-wq
duplicate
High
Arbitrary Code Execution via Unsafe Pickle Deserialization in SimpleObjectNodeMa...
l1iith
duplicate
High
Sandbox Bypass → Remote Code Execution in `safe_eval`/`safe_exec` via `pd.io.com...
l1iith
duplicate
Critical
SQL Injection in DB2 Vector Store `delete()`, `query()`, and metadata filter met...
l1iith
duplicate
Critical
Sandbox Bypass
jeremylaratro
duplicate
Critical
SQL Injection in Additional Vector Stores Not Resolved by CVE-2025-1793
responsiblereport10
duplicate
Critical
SQL Injection in DB2 Vector Store via `delete()`, `query()`, and `_append_meta_f...
maniketabchi
duplicate
Critical
Remote Code Execution via Documentation-Recommended PickleSerializer in Workflow...
edferr
duplicate
Critical
Bypass of CVE-2024-003 Sandbox Logic in safe_eval
anandppatil
duplicate
Critical
PandasQueryEngine safe_exec sandbox bypass via whitelisted imports (pandas/numpy...
theagentknownasren-gif
duplicate
Critical
PandasQueryEngine safe_exec sandbox bypass via whitelisted imports (pandas/numpy...
theagentknownasren-gif
duplicate
Critical
Systemic SQL Injection in 10+ Vector Store Integrations via Unsanitized Metadata...
jhacksman
duplicate
High
LlamaIndex TextToCypherRetriever Prompt Injection leads to Cypher Injection and...
mia-718ai
duplicate
Critical
Arbitrary Code Execution in download_llama_module() via Unverified Remote Code D...
mia-718ai
informative
High
JSONReader.load_data() Arbitrary File Read via Path Traversal (CWE-22)
mia-718ai
informative
High
Server-Side Request Forgery (SSRF) in llama_index Download Module Allows Access...
mia-718ai
duplicate
Critical
SQL Injection in SQLRetriever.retrieve_with_metadata() allows arbitrary database...
mia-718ai
informative
Critical
Server Side Request Forgery in ImageNode.resolve_image() method
yashvardhantrip
informative
High
Sandbox Bypass via pandas.read_pickle() leads to Remote Code Execution
yashvardhantrip
informative
High
Server Side Request Forgery in ImageNode.resolve_image() method
yashvardhantrip
duplicate
High
RCE via Pickle Deserialization in SimpleObjectNodeMapping.from_persist_dir()
yashvardhantrip
duplicate
High
Unsafe Pickle Deserialization in SimpleObjectNodeMapping Enables Remote Code Exe...
sanu1999
duplicate
High
Path Traversal via Symbolic Links in SimpleDirectoryReader Allows Arbitrary File...
sanu1999
duplicate
Medium
DatabaseReader SQL Injection Vulnerability Report
fhkkmd637
informative
Critical
Remote Code Execution in SimpleObjectNodeMapping via Unsafe Pickle Deserializati...
mr-neutr0n
duplicate
Critical
Arbitrary Code Execution via Unsafe pickle.load() and torch.load() in Index/Adap...
sermikr0
not applicable
Sandbox Bypass via str.format() Allows Information Disclosure of __globals__ and...
alan-tiger
informative
Medium
Arbitrary File Write via Sandbox Bypass in PandasQueryEngine (Prompt Injection)
unicuervo16
informative
Critical
XML External Entity (XXE) Injection in DocugamiReader via Unsafe XML Parsing
bademeischta
informative
Critical
Uncontrolled Recursion in `JSONNodeParser` Leads to Stack Overflow DoS in run-ll...
nova-aryan
duplicate
High
Blind SQL Injection in NLSQLTableQueryEngine via Prompt Injection allows Databas...
bademeischta
informative
Critical
Arbitrary Argument Injection in download_integration leading to potential RCE
espanda666
informative
High
Remote Code Execution (RCE) via Indirect Prompt Injection in EvaporateExtractor
espanda666
duplicate
Critical
Remote code execution vulnerability in that bypasses code checks
ka7arotto
duplicate
Critical
Unsafe Sandbox Bypass in llama_index's safe_exec and safe_eval Functions Allows...
to-be-w1th0ut
duplicate
Critical
LlamaIndex Remote Code Execution via safe_exec + Malicious Pickle
to-be-w1th0ut
duplicate
Critical
Authorization Boundary Bypass in NLSQLTableQueryEngine allowing Unauthorized Acc...
aldorizona10-glitch
not applicable
Denial of Service via Malformed GGUF Model Causing Memory Allocation Failure in...
aldorizona10-glitch
spam
Unbounded Image Metadata Forwarded to Pillow Causes Remote Denial-of-Service via...
hyperps
informative
High
SQL Injection via MetadataFilter.key in PGVectorStore (_build_filter_clause)
vitalysim
informative
Critical
Arbitrary File Read in llama_index via ImageDocument Setter (Bypass of CVE-2025-...
nigh7c0r3
duplicate
High
HWP Reader Decompression Bomb (Memory Exhaustion DoS)
bilisheep
informative
High
Critical RCE in LlamaIndex FAISS Vector Store via Unsafe Deserialization
skypher
duplicate
Critical
Arbitrary Code Execution (RCE) via Unsafe Pickle Deserialization in SimpleObject...
pygmalionsimon
duplicate
Critical
SQL Injection in ref_doc_id parameter
maticmindsecurityresearchteam
duplicate
Critical
LlamaIndex Repository Deserialization Vulnerabilities
7908837174
duplicate
Critical
vector Database Poisoning via Unvalidated Embeddings
daridor9
not applicable
Remote Code Execution (RCE) via Unsafe Argument Introspection in LlamaIndex Inst...
hyperps1
informative
Critical
SQL Injection in NebulaGraph Store Allowing Complete Database Compromise
shawkatabdelhaq
self closed
Critical XXE and XML Injection Vulnerabilities in llama-index Agent Utils
shawkatabdelhaq
spam
Remote Code Execution via Unsafe Pickle Deserialization
mufeedvh
not applicable
Remote Code Execution via NumPy ctypes in PolarsInstructionParser.parse
mufeedvh
not applicable
Remote Code Execution via Unsafe Pickle Deserialization in SimpleObjectNodeMappi...
itsbalvant
not applicable
Remote Code Execution via Unsafe Pickle Deserialization in BGEM3Index (multi_emb...
itsbalvant
not applicable
Remote Code Execution via Unsafe Pickle Deserialization in 'TxtaiVectorStore'
itsbalvant
not applicable
Arbitrary Code Execution via eval() in FaissMapVectorStore id_map Loader
itsbalvant
not applicable
Insecure File Persistence in SimpleVectorStore Exposes Sensitive Data
0xmrniko
not applicable
SQL Injection in ClickHouse Vector Store Metadata Filtering
mysterious75
informative
Critical
Server-Side Request Forgery (SSRF) in LlamaIndex SimpleWebPageReader allows acce...
gauss-security
duplicate
Critical
Critical Template Injection in GitHub Actions Workflows
anasboulbali
not applicable
Path Traversal via SimpleDirectoryReader
choocs
not applicable
SQL Injection in Vector Search via Bigquery
faizann24
informative
Critical
JSON Injection Vulnerability in LlamaIndex Question Generation Module Leading to...
damcrazy
spam
Race Condition in FunctionCallingAgentWorker
madan301
informative
High
Arbitary File Read Through Path Traversal
choocs
duplicate
High
DoS through image-URL-validation
patrik-ha
informative
High
No Check for Duplicate Entries
madan301
not applicable
No State Rollback on Partial Failure
madan301
not applicable
Command Injection Vulnerability in llama-index-tools-mcp
bayuncao-bit
informative
Critical
Silent Duplicate Dispatcher Registration Vulnerability
madan301
not applicable
Context Reset Workaround Vulnerability in Async Span Management
madan301
not applicable
Shared State Vulnerability in llama_index_instrumentation Dispatcher Due to Muta...
madan301
informative
High
Deepseek API Key Leaked on Repository
aydinnyunus
informative
Medium
SSRF VULNERABILITY REPORT - LLAMA-INDEX
jplopezy
duplicate
High
Backoff Retry Functions in run-llama/llama_index Allow Resource Exhaustion via I...
madan301
informative
Medium
World-Writable NLTK Cache Directory Enables Local Users to Tamper with or Delete...
madan301
High
•$750•CVE-2025-7707
OS Command Injection in llama-index-cli RAG Tool
colemurray
informative
High
Insecure Temporary File Handling Vulnerability in llama-index-core
anwarayoob
High
•$750•CVE-2025-7647
Pickle Deserialization Remote Code Execution in llama-index-core
anwarayoob
informative
Critical
XML Entity Expansion vulnerability in XMLReader
anwarayoob
informative
Medium
Path Traversal in `ObsidianReader`
ouxs-19
informative
High
llama_index.readers.file.paged_csv has an arbitrary file read vulnerability
chy4412312
informative
High
Denial of Service via UnstructuredReader split document path
0xmanan
informative
Medium
access key leaks in [Alibaba Cloud]
rashidkhanpathan
informative
Medium
SQL Injection in Multiple Vector Stores via Unsanitized Input in delete Method D...
kunstnicht
informative
Critical
CQL Injection in LlamaIndex Cassandra Integration
mohit121312
informative
Critical
XML Entity Expansion vulnerability in XMLReader
makerdd
duplicate
High
SQL Injection in RelytVectorStore#init_index() can lead to RCE
liankee
informative
Critical