llama-index vulnerabilities
CVEs whose affected-version data names the llama-index package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2025-6211Medium· 6.5LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class
LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class
▾ Sunlitllama-index · llama-indexEPSS 0.36%via OSV
CVE-2025-1793Critical· 9.8llama_index vulnerable to SQL Injection
llama_index vulnerable to SQL Injection
▾ Midnightllama-index · llama-indexEPSS 0.66%via OSV
CVE-2025-1752High· 7.5LlamaIndex Vulnerable to Denial of Service (DoS)
LlamaIndex Vulnerable to Denial of Service (DoS)
▾ Twilightllama-index · llama-indexEPSS 0.52%via OSV
CVE-2024-12911High· 7.1LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions
LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions
▾ Twilightllama-index · llama-indexEPSS 0.52%via OSV
CVE-2024-4181High· 8.8RunGptLLM class in LlamaIndex has a command injection
RunGptLLM class in LlamaIndex has a command injection
▾ Twilightllama-index · llama-indexEPSS 2.1%via OSV