repository icon
run-llama / llama_index Project repository

LlamaIndex is a data framework for your LLM applications

Submit a report

FIRST INTERACTION

WITHIN16 DAYS

REVIEW

WITHIN16 DAYS

FIX

WITHINN/A DAYS

SSRF via unvalidated image URL fetching in core schema classes
pulkit7070
duplicate
High
Sandbox Escape via Shallow AST Import Check in PandasQueryEngine exec_utils.py
hacnho
duplicate
High
SSRF via unvalidated image_url in multi-modal LLM generic_utils and schema
tranhoangtu-it
duplicate
Critical
Unauthenticated RCE via Path Traversal in download_dataset_and_source_files
jdp-security
not applicable
Arbitrary Code Execution (RCE) via Sandbox Bypass in LlamaIndex (PandasQueryEngi...
catalyzer9867
duplicate
Critical
Supply Chain RCE via Unsanitized pip install in download_integration()
jdhart81
duplicate
Critical
SSRF in llama_index: ImageNode.resolve_image() and 5 other code paths fetch arbi...
caoxuyang
duplicate
High
SSRF via Unvalidated Image URLs in Multi-Modal Document Schema and LLM Utils
nhomyk
duplicate
High
SQL Injection in llama-index-vector-stores-db2 and llama-index-vector-stores-cou...
ar03
duplicate
Critical
Arbitrary code execution via unsanitized llama_hub_url in download_llama_module(...
rishavkumarthapa01-sketch
duplicate
High
Sandbox Escape via Nested Import Bypass and Missing __builtins__ Restriction in...
phenggeler
duplicate
None
Arbitrary Code Execution via Pickle Deserialization in EmbeddedTablesUnstructure...
manja316
duplicate
Critical
Unsafe pickle.load() in BGEM3Index.load_from_disk() Enables RCE via Malicious In...
odysseypro25-project
self closed
Unsafe pickle deserialization in EmbeddedTablesUnstructuredRetrieverPack leads t...
narrator3333-hash
duplicate
Critical
SQL Injection via Unparameterized f-string Query Construction in Multiple Vector...
elucidator-hky
duplicate
High
Server-Side Request Forgery (SSRF) in Core Schema and Multiple Web Readers Due t...
elucidator-hky
self closed
Arbitrary code execution via unsafe pickle.load() and torch.load() in multiple L...
elucidator-hky
self closed
LlamaIndex: exec() Code Execution with Bypassable Sandbox in Evaporate Extractor
iamveene
self closed
LlamaIndex: SSRF via SimpleWebPageReader -- No URL Validation or Private IP Bloc...
iamveene
self closed
LlamaIndex: RAG Indirect Prompt Injection via Unsanitized Document Context Inser...
iamveene
self closed
LlamaIndex: Supply Chain RCE via download_llama_module Without Integrity Verific...
iamveene
duplicate
High
Unprotected pickle.load() in 5 Locations Across 4 LlamaIndex Integration Package...
iamveene
self closed
Sandbox escape in exec_utils allows arbitrary command execution
vnykmshr
duplicate
Critical
Sandbox Bypass in safe_exec / safe_eval leading to Remote Code Execution (RCE) v...
amitzalman
duplicate
Critical
Sandbox Escape via AST Bypass and __builtins__ Injection in safe_exec leads to R...
uchiha100x
self closed
SQL Injection via MetadataFilter key/value in 7 Vector Store query() Paths (Mari...
d3banjan
self closed
NoSQL Injection in AzureCosmosDBNoSqlVectorSearch `delete()` and `_query()` Meth...
hiyokosauna37
self closed
Sandbox Escape in Evaporate Extractor via chr()+operator.attrgetter — Remote Cod...
apeiria-zero
duplicate
Critical
AST Sandbox Bypass via eval/exec string literals in _validate_generated_code() l...
erc840902
duplicate
Critical
Unsafe pickle.load() in SimpleObjectNodeMapping.from_persist_dir() enables arbit...
sinhsinhan
duplicate
Critical
LlamaIndex SSRF via Unvalidated Image URL Fetching in LanceDB Integration - Acce...
avienma007
duplicate
Critical
Unsafe Pickle Deserialization in Object Node Mapping Achieves RCE
jeremysommerfeld8910-cpu
duplicate
High
Sandbox Escape via operator.attrgetter in Evaporate Extractor Achieves RCE
jeremysommerfeld8910-cpu
duplicate
Critical
Sandbox Bypass in "safe_exec/safe_eval" Leads to Remote Code Execution
nakosec
duplicate
Critical
SSRF via Unvalidated URL in `LanceDBRetriever` Multimodal Query Functions (`quer...
soze-ki
duplicate
High
PandasQueryEngine Sandbox Escape via pd.io.common.os Module Attribute Traversal
wernerina
duplicate
Critical
Server-Side Request Forgery (SSRF) via Unvalidated URL in SimpleWebPageReader
invisiblemonsters
duplicate
High
Insecure Deserialization in SimpleObjectNodeMapping.from_persist_dir()
loris4py
duplicate
Critical
SQL Injection in Alibaba Cloud MySQL Vector Store via Unsanitized Metadata Filte...
mehmedbesim
duplicate
Critical
Sandbox Escape via operator.attrgetter in EvaporateExtractor
optimus-fulcria
informative
High
SQL Injection in PGVectorStore _build_filter_clause via unsanitized MetadataFilt...
shima-coder
informative
Critical
Incomplete Fix for CVE-2025-5302: Uncontrolled Recursion in JSONNodeParser
gigafyde
informative
Medium
Arbitrary Credential Leakage via SSRF in JiraReader (`llama-index-readers-jira`)
catalyzer9867
informative
Critical
Server-Side Request Forgery (SSRF) via ChatMessage legacy image validation
edferr
informative
High
Server-Side Request Forgery (SSRF) in Multiple Web Reader Components
galanzi2580-wq
duplicate
High
Remote Code Execution (RCE) via Prompt Injection in LlamaIndex Tool Call Executi...
sebas5207418
informative
Critical
Remote Code Execution via Insecure Integration in `UnstructuredReader`
edferr
informative
Critical
Arbitrary Code Execution via Unsafe Pickle Deserialization in SimpleObjectNodeMa...
l1iith
duplicate
High
Sandbox Bypass → Remote Code Execution in `safe_eval`/`safe_exec` via `pd.io.com...
l1iith
duplicate
Critical
SQL Injection in DB2 Vector Store `delete()`, `query()`, and metadata filter met...
l1iith
duplicate
Critical
NoSQL Injection in Azure CosmosDB NoSQL Vector Store delete() and query() method...
l1iith
informative
Critical
FaissMapVectorStore.from_persist_path() uses eval() on data file enabling arbitr...
jeremylaratro
duplicate
High
Sandbox Bypass
jeremylaratro
duplicate
Critical
SQL++ Injection in CouchbaseQueryVectorStore via Unescaped MetadataFilter Values...
edferr
informative
Critical
SQL Injection in Additional Vector Stores Not Resolved by CVE-2025-1793
responsiblereport10
duplicate
Critical
Improper Link Resolution Before File Access in llama-index-readers-file class `...
shangzhixu
informative
High
SQL Injection in DB2 Vector Store via `delete()`, `query()`, and `_append_meta_f...
maniketabchi
duplicate
Critical
Remote Code Execution via Documentation-Recommended PickleSerializer in Workflow...
edferr
duplicate
Critical
ML Model Exfiltration via Confused Deputy Deserialization in Workflows
edferr
informative
High
Path Traversal + Pickle Deserialization RCE in llama-index-packs-panel-chatbot
vulnhunter505
not applicable
DocugamiReader XXE via lxml.etree.parse() without secure parser
responsiblereport10
not applicable
Bypass of CVE-2024-003 Sandbox Logic in safe_eval
anandppatil
duplicate
Critical
Critical Indirect Prompt Injection in MultiStepQueryEngine via Metadata Hijackin...
dascreed2
not applicable
Remote Code Execution via eval() in FaissMapVectorStore.from_persist_path()
222n5
not applicable
PandasQueryEngine safe_exec sandbox bypass via whitelisted imports (pandas/numpy...
theagentknownasren-gif
duplicate
Critical
PandasQueryEngine safe_exec sandbox bypass via whitelisted imports (pandas/numpy...
theagentknownasren-gif
duplicate
Critical
Systemic SQL Injection in 10+ Vector Store Integrations via Unsanitized Metadata...
jhacksman
duplicate
High
LlamaIndex TextToCypherRetriever Prompt Injection leads to Cypher Injection and...
mia-718ai
duplicate
Critical
Arbitrary Code Execution in download_llama_module() via Unverified Remote Code D...
mia-718ai
informative
High
JSONReader.load_data() Arbitrary File Read via Path Traversal (CWE-22)
mia-718ai
informative
High
Server-Side Request Forgery (SSRF) in llama_index Download Module Allows Access...
mia-718ai
duplicate
Critical
SQL Injection in SQLRetriever.retrieve_with_metadata() allows arbitrary database...
mia-718ai
informative
Critical
Server Side Request Forgery in ImageNode.resolve_image() method
yashvardhantrip
informative
High
Sandbox Bypass via pandas.read_pickle() leads to Remote Code Execution
yashvardhantrip
informative
High
Server Side Request Forgery in ImageNode.resolve_image() method
yashvardhantrip
duplicate
High