EUVD-2025-34071

llama-index has Insecure Temporary File...

CVE-2025-7707

The CVE-2025-7707 entry concerns llama_index 0.12.33, where NLTK data directory is set to a subdirectory of the codebase, creating a world-writable shared cache and enabling local data tampering, DoS, or privilege escalation. Connected disclosures confirm the issue and point to fixes/upgrades: re...

PYSEC-2025-249

A critical deserialization vulnerability exists in the run-llama/llamaindex library's JsonPickleSerializer component, affecting versions v0.12.27 through v0.12.40. This vulnerability allows remote code execution due to an insecure fallback to Python's pickle module. JsonPickleSerializer prioritiz...

PT-2024-29576

Name of the Vulnerable Software and Affected Versions llama index library version 0.9.47 Description A command injection issue exists due to the improper use of the eval function in the RunGptLLM class, allowing a malicious LLM hosting provider to execute arbitrary commands on the client's machin...