Medium
CVE-2025-6208
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 29
Reset filters
High
CVE-2025-7707
llama-index has Insecure Temporary File
High
CVE-2025-7647
llama-index-core insecurely handles temporary files
High
CVE-2025-5302
LlamaIndex affected by a Denial of Service (DOS) in JSONReader
Medium
CVE-2025-6211
LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class
High
CVE-2025-1752
LlamaIndex Vulnerable to Denial of Service (DoS)
High
CVE-2024-12911
LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions
Critical
CVE-2025-1793
llama_index vulnerable to SQL Injection
Critical
CVE-2024-11958
LlamaIndex Retrievers Integration: DuckDBRetriever SQL Injection
High
CVE-2024-58339
LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. The custom_query() l
High
CVE-2024-14021
LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The
High
CVE-2025-6209
LlamaIndex vulnerable to Path Traversal attack through its encode_image function
Medium
CVE-2025-5472
LlamaIndex vulnerable to DoS attack through uncontrolled recursive JSON parsing
Medium
CVE-2025-6210
LlamaIndex vulnerability in its ObsidianReader class can lead to Path Traversal exploit
High
CVE-2025-3225
LlamaIndex has an XML Entity Expansion vulnerability in its sitemap parser
Medium
CVE-2025-3044
LlamaIndex vulnerability in ArxivReader class can cause MD5 hash collisions
High
CVE-2025-3046
LlamaIndex is vulnerable to Path Traversal attack through its ObsidianReader class
Medium
CVE-2025-3108
LlamaIndex has Incomplete Documentation of Program Execution related to JsonPickleSerializer component
Critical
CVE-2025-1750
LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id
High
CVE-2025-1753
LLama-Index CLI OS command injection vulnerability
Critical
CVE-2024-12909
llama-index-packs-finchat SQL Injection vulnerability
Medium
CVE-2024-12910
A vulnerability in the `KnowledgeBaseWebReader` class of the run-llama/llama_index repository, version latest, allows an attacker to cause a Denial of Service (DoS) by controlling a URL variable to co
High
CVE-2024-12704
LlamaIndex Improper Handling of Exceptional Conditions vulnerability
Critical
CVE-2024-45201
LlamaIndex includes an exec call for `import {cls_name}`
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.