Category · 21 advisories
LLM frameworks
Libraries and runtimes for building and serving LLM apps.
Timeline · advisories per quarter
22023 Q4
12024 Q1
22024 Q2
22024 Q3
22024 Q4
32025 Q2
12025 Q4
12026 Q1
42026 Q2
32026 Q3
All advisories, worst first
01. CVE-2026-37004: LiteLLM vulnerable to server-side template injection in the /prompts/test endpointBerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment. 
LiteLLM 2026-08-27 02. CVE-2026-49468: LiteLLM: Authentication Bypass via Host Header InjectionA Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. LiteLLM 2026-06-16 03. CVE-2026-42208: LiteLLM has SQL Injection in Proxy API key verificationA database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. LiteLLM 2026-04-24 04. CVE-2026-22778: vLLM has RCE In Video ProcessingvLLM has RCE In Video Processing. 
vLLM 2026-02-02 05. CVE-2025-63389: Ollama Platform has missing authentication enabling attackers to perform model management operationsA critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations. 
Ollama 2025-12-18 06. CVE-2025-1793: llama_index vulnerable to SQL InjectionMultiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. 
LlamaIndex 2025-06-05 07. CVE-2025-47277: vLLM Allows Remote Code Execution via PyNcclPipe Communication ServicevLLM Allows Remote Code Execution via PyNcclPipe Communication Service. vLLM 2025-05-20 08. CVE-2025-32444: vLLM Vulnerable to Remote Code Execution via Mooncake IntegrationvLLM integration with mooncake is vaulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. vLLM 2025-04-29 09. CVE-2024-46946: LangChain Experimental Eval Injection vulnerabilitylangchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05). 
LangChain 2024-09-19 10. CVE-2024-45201: LlamaIndex includes an exec call for `import {cls_name}`An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}. LlamaIndex 2024-08-22 11. CVE-2024-3271: llama-index-core Command Injection vulnerabilityA command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. LlamaIndex 2024-04-16 12. CVE-2024-27444: LangChain Experimental vulnerable to arbitrary code executionlangchain_experimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__… LangChain 2024-02-26 13. CVE-2023-6730: transformers has a Deserialization of Untrusted Data vulnerabilityDeserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.0. 
Hugging Face 2023-12-19 14. CVE-2023-32785: Langchain SQL Injection vulnerabilityIn Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain. LangChain 2023-10-21 15. CVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originAny authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. 
Open WebUI 2026-09-10 16. CVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messagesAny authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Open WebUI 2026-08-04 17. CVE-2026-45672: Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassedThe /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes. Open WebUI 2026-05-14 18. CVE-2026-7482: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loaderOllama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. Ollama 2026-05-04 19. CVE-2024-11393: Deserialization of Untrusted Data in Hugging Face TransformersHugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. Hugging Face 2024-11-23 20. CVE-2024-11394: Deserialization of Untrusted Data in Hugging Face TransformersHugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. Hugging Face 2024-11-23 21. CVE-2024-28224: Ollama DNS rebinding vulnerabilityOllama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion). Ollama 2024-04-08
LiteLLM 2026-08-27 02. CVE-2026-49468: LiteLLM: Authentication Bypass via Host Header InjectionA Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to protected management routes. LiteLLM 2026-06-16 03. CVE-2026-42208: LiteLLM has SQL Injection in Proxy API key verificationA database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. LiteLLM 2026-04-24 04. CVE-2026-22778: vLLM has RCE In Video ProcessingvLLM has RCE In Video Processing. vLLM 2026-02-02 05. CVE-2025-63389: Ollama Platform has missing authentication enabling attackers to perform model management operationsA critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multiple API endpoints without requiring authentication, enabling remote attackers to perform unauthorized model management operations. Ollama 2025-12-18 06. CVE-2025-1793: llama_index vulnerable to SQL InjectionMultiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. LlamaIndex 2025-06-05 07. CVE-2025-47277: vLLM Allows Remote Code Execution via PyNcclPipe Communication ServicevLLM Allows Remote Code Execution via PyNcclPipe Communication Service. vLLM 2025-05-20 08. CVE-2025-32444: vLLM Vulnerable to Remote Code Execution via Mooncake IntegrationvLLM integration with mooncake is vaulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. vLLM 2025-04-29 09. CVE-2024-46946: LangChain Experimental Eval Injection vulnerabilitylangchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through sympy.sympify (which uses eval) in LLMSymbolicMathChain. LLMSymbolicMathChain was introduced in fcccde406dd9e9b05fc9babcbeb9ff527b0ec0c6 (2023-10-05). LangChain 2024-09-19 10. CVE-2024-45201: LlamaIndex includes an exec call for `import {cls_name}`An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}. LlamaIndex 2024-08-22 11. CVE-2024-3271: llama-index-core Command Injection vulnerabilityA command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. LlamaIndex 2024-04-16 12. CVE-2024-27444: LangChain Experimental vulnerable to arbitrary code executionlangchain_experimental (aka LangChain Experimental) before 0.0.52, part of LangChain before 0.1.8, allows an attacker to bypass the CVE-2023-44467 fix and execute arbitrary code via the __import__, __subclasses__, __builtins__, __globals__, __getattribute__, __bases__, __mro__, or __base__… LangChain 2024-02-26 13. CVE-2023-6730: transformers has a Deserialization of Untrusted Data vulnerabilityDeserialization of Untrusted Data in GitHub repository huggingface/transformers prior to 4.36.0. Hugging Face 2023-12-19 14. CVE-2023-32785: Langchain SQL Injection vulnerabilityIn Langchain before 0.0.247, prompt injection allows execution of arbitrary code against the SQL service provided by the chain. LangChain 2023-10-21 15. CVE-2026-87995: Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-originAny authenticated user with access to a shared terminal server could get script of their choosing to run in the Open WebUI origin itself. Open WebUI 2026-09-10 16. CVE-2026-70492: Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messagesAny authenticated user can store a chat message whose math block makes KaTeX fail with a stack overflow instead of a parse error. Open WebUI 2026-08-04 17. CVE-2026-45672: Open WebUI: Jupyter code execution works despite `ENABLE_CODE_EXECUTION=false` — feature gate bypassedThe /api/v1/utils/code/execute endpoint executes arbitrary Python code via Jupyter for any verified user, even when the admin has set ENABLE_CODE_EXECUTION=false. The feature gate is not enforced on the API endpoint — the configuration says "disabled" but code still executes. Open WebUI 2026-05-14 18. CVE-2026-7482: Ollama contains a heap out-of-bounds read vulnerability in the GGUF model loaderOllama before 0.17.1 contains a heap out-of-bounds read vulnerability in the GGUF model loader. Ollama 2026-05-04 19. CVE-2024-11393: Deserialization of Untrusted Data in Hugging Face TransformersHugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. Hugging Face 2024-11-23 20. CVE-2024-11394: Deserialization of Untrusted Data in Hugging Face TransformersHugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. Hugging Face 2024-11-23 21. CVE-2024-28224: Ollama DNS rebinding vulnerabilityOllama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthorized user chat with a large language model, delete a model, or cause a denial of service (resource exhaustion). Ollama 2024-04-08