llama-index-core vulnerable to Uncontrolled Resource Consumption

The SimpleDirectoryReader component in llamaindex.core version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The vulnerability arises because the user-specified file limit numfileslimit is applied after all files in a directory are loaded into memory. Thi...

PYSEC-2026-1560 llama-index-core vulnerable to Uncontrolled Resource Consumption

The SimpleDirectoryReader component in llamaindex.core version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The vulnerability arises because the user-specified file limit numfileslimit is applied after all files in a directory are loaded into memory. Thi...

aimon-llamaindex (>=0.0.6, <=0.0.9), aiqtoolkit-llama-index (>=1.1.0a20250429, <=1.2.0rc1) +672 more potentially affected by CVE-2025-6208 via llama-index-core (>=0.9.56, <=0.12.39)

llama-index-core PYPI version =0.9.56, =0.0.6, =1.1.0a20250429, =3.0.0, =1.0.0, =0.0.3, =1.0.0rc1, =0.2.1.dev0, =0.2.1.dev0, =0.1.3, =0.1.169, =0.1.3, =0.3.0, =0.1.0b1, =0.0.52, =0.0.2, =0.0.5 and more Source cves: CVE-2025-6208 Source advisory: OSV:PYSEC-2026-1560...

PYSEC-2026-1562 llama-index-core insecurely handles temporary files

The llama-index-core package, up to version 0.12.44, contains a vulnerability in the getcachedir function where a predictable, hardcoded directory path /tmp/llamaindex is used on Linux systems without proper security controls. This vulnerability allows attackers on multi-user systems to steal...

agent-path (>=0.1.0, <=0.1.2), agentc-llamaindex (0.2.5a2) +830 more potentially affected by CVE-2025-7647 via llama-index-core (>=0.9.56, <=0.12.52.post1)

llama-index-core PYPI version =0.9.56, =0.1.0, =0.0.2, =0.1.0a0.dev0, =0.2.0a0, =0.0.6, =1.1.0a20250429, =3.0.0, =1.0.5, =0.1.0, =1.0.0, =0.0.3, =1.0.0rc1, =0.2.0, =0.2.1 and more Source cves: CVE-2025-7647 Source advisory: OSV:PYSEC-2026-1562...

aimon-llamaindex (>=0.0.6, <=0.0.9), aiqtoolkit-llama-index (>=1.1.0a20250429, <=1.2.0rc1) +672 more potentially affected by CVE-2025-5302 via llama-index-core (>=0.9.56, <=0.12.37)

llama-index-core PYPI version =0.9.56, =0.0.6, =1.1.0a20250429, =3.0.0, =1.0.0, =0.0.3, =1.0.0rc1, =0.2.1.dev0, =0.2.1.dev0, =0.1.3, =0.1.169, =0.1.3, =0.3.0, =0.1.0b1, =0.0.52, =0.0.2, =0.0.5 and more Source cves: CVE-2025-5302 Source advisory: OSV:PYSEC-2026-1561...

aimon-llamaindex (>=0.0.6, <=0.0.9), aiqtoolkit-llama-index (>=1.1.0a20250429, <=1.2.0rc1) +604 more potentially affected by CVE-2025-6209 via llama-index-core (>=0.11.23, <=0.12.39)

llama-index-core PYPI version =0.11.23, =0.0.6, =1.1.0a20250429, =3.0.0, =1.0.0rc1, =0.2.1.dev3, =0.1.169, =0.3.0, =0.1.0b1, =0.0.52, =0.0.2, =0.0.1, =0.1.2, =0.1.7.dev20240924104148, =0.6.0.dev20241204051808 and more Source cves: CVE-2025-6209 Source advisory: OSV:PYSEC-2026-1558...

aimon-llamaindex (>=0.0.6, <=0.0.9), aiqtoolkit-llama-index (>=1.1.0a20250429, <=1.2.0rc1) +672 more potentially affected by CVE-2025-5472 via llama-index-core (>=0.9.56, <=0.12.37)

llama-index-core PYPI version =0.9.56, =0.0.6, =1.1.0a20250429, =3.0.0, =1.0.0, =0.0.3, =1.0.0rc1, =0.2.1.dev0, =0.2.1.dev0, =0.1.3, =0.1.169, =0.1.3, =0.3.0, =0.1.0b1, =0.0.52, =0.0.2, =0.0.5 and more Source cves: CVE-2025-5472 Source advisory: OSV:PYSEC-2026-1559...

aimon-llamaindex (>=0.0.6, <=0.0.9), aiqtoolkit-llama-index (>=1.1.0a20250429, <=1.2.0rc1) +604 more potentially affected by CVE-2025-3108 via llama-index-core (>=0.11.23, <=0.12.39)

llama-index-core PYPI version =0.11.23, =0.0.6, =1.1.0a20250429, =3.0.0, =1.0.0rc1, =0.2.1.dev3, =0.1.169, =0.3.0, =0.1.0b1, =0.0.52, =0.0.2, =0.0.1, =0.1.2, =0.1.7.dev20240924104148, =0.6.0.dev20241204051808 and more Source cves: CVE-2025-3108 Source advisory: OSV:PYSEC-2026-1564...

airunner (>=3.0.0, <=3.1.7), blar-graph (>=1.0.0, <=1.1.6) +664 more potentially affected by CVE-2024-12704 via llama-index-core (>=0.9.56, <=0.12.0)

llama-index-core PYPI version =0.9.56, =3.0.0, =1.0.0, =0.0.3, =0.2.1.dev0, =0.2.1.dev0, =0.1.3, =0.1.169, =0.1.3, =0.3.0, =0.1.0b1, =0.0.52, =0.0.2, =1.0.9, =1.0.3.post1, =1.0.23.post1 and more Source cves: CVE-2024-12704 Source advisory: OSV:PYSEC-2026-1563...

clarifai-datautils (>=0.0.3, <=0.0.7), langtrace-python-sdk (>=1.0.9, <=1.1.30) +377 more potentially affected by CVE-2024-45201 via llama-index-core (>=0.9.56, <=0.10.36)

llama-index-core PYPI version =0.9.56, =0.0.3, =1.0.9, =1.0.3.post1, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =0.1.0 and more Source cves: CVE-2024-45201 Source advisory: OSV:PYSEC-2026-395...

llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution

A vulnerability was identified in the executils class of the llamaindex package, specifically within the safeeval function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method...

llama-index-core Command Injection vulnerability

A command injection vulnerability exists in the run-llama/llamaindex repository, specifically within the safeeval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. This is achieved by...

langtrace-python-sdk (>=1.0.9, <=1.1.30), lavague (>=1.0.3.post1, <=1.0.15) +376 more potentially affected by CVE-2024-3271 via llama-index-core (>=0.9.56, <=0.10.19)

llama-index-core PYPI version =0.9.56, =1.0.9, =1.0.3.post1, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =0.0.1, =0.1.0 and more Source cves: CVE-2024-3271 Source advisory: OSV:PYSEC-2026-396...

langtrace-python-sdk (>=1.0.9, <=1.1.30), lavague (>=1.0.3.post1, <=1.0.15) +376 more potentially affected by CVE-2024-3098 via llama-index-core (>=0.9.56, <=0.10.19)

llama-index-core PYPI version =0.9.56, =1.0.9, =1.0.3.post1, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =0.0.1, =0.1.0 and more Source cves: CVE-2024-3098 Source advisory: OSV:PYSEC-2026-397...

Security Bulletin: Vulnerabilities in llama_index_core bundled with IBM Fusion, IBM Fusion HCI and Content-Aware Storage.

Summary IBM Fusion, IBM Fusion HCI and Content-Aware Storage includes llamaindexcore which could allow Denial of Service DoS, steal proprietary models, poison cached embeddings, conduct symlink attacks. CVE-2025-5472, CVE-2024-12911, CVE-2024-12704, CVE-2025-5302, CVE-2025-7647. Vulnerability...

Allocation of Resources Without Limits or Throttling

Overview llama-index-core is an Interface between LLMs and your data Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the SimpleDirectoryReader class readers/file/base.py. The configured numfileslimit is respected, but enforced after all...

aimon-llamaindex (>=0.0.6, <=0.0.9), aiqtoolkit-llama-index (>=1.1.0a20250429, <=1.2.0rc1) +672 more potentially affected by CVE-2025-6208 via llama-index-core (>=0.9.56, <=0.12.39)

llama-index-core PYPI version =0.9.56, =0.0.6, =1.1.0a20250429, =3.0.0, =1.0.0, =0.0.3, =1.0.0rc1, =0.2.1.dev0, =0.2.1.dev0, =0.1.3, =0.1.169, =0.1.3, =0.3.0, =0.1.0b1, =0.0.52, =0.0.2, =0.0.5 and more Source cves: CVE-2025-6208 Source advisory: SNYK:PYTHON-LLAMAINDEXCORE-15170850...

aimon-llamaindex (>=0.0.6, <=0.0.9), aiqtoolkit-llama-index (>=1.1.0a20250429, <=1.2.0rc1) +672 more potentially affected by CVE-2025-6208 via llama-index-core (>=0.9.56, <=0.12.39)

llama-index-core PYPI version =0.9.56, =0.0.6, =1.1.0a20250429, =3.0.0, =1.0.0, =0.0.3, =1.0.0rc1, =0.2.1.dev0, =0.2.1.dev0, =0.1.3, =0.1.169, =0.1.3, =0.3.0, =0.1.0b1, =0.0.52, =0.0.2, =0.0.5 and more Source cves: CVE-2025-6208 Source advisory: OSV:GHSA-488G-HW5F-X29P...

GHSA-488G-HW5F-X29P llama-index-core vulnerable to Uncontrolled Resource Consumption

The SimpleDirectoryReader component in llamaindex.core version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The vulnerability arises because the user-specified file limit numfileslimit is applied after all files in a directory are loaded into memory. Thi...