LLM frameworks · LlamaIndex
LlamaIndex
Data framework for RAG and agent apps.
3Advisories
3critical
0high
0medium
2025-06-05Latest
Timeline · advisories per quarter
12024 Q2
12024 Q3
12025 Q2
Named in sources
Reported for LlamaIndex
01. CVE-2025-1793: llama_index vulnerable to SQL InjectionMultiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. LlamaIndex 2025-06-05 02. CVE-2024-45201: LlamaIndex includes an exec call for `import {cls_name}`An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}. LlamaIndex 2024-08-22 03. CVE-2024-3271: llama-index-core Command Injection vulnerabilityA command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. LlamaIndex 2024-04-16
LlamaIndex 2025-06-05 02. CVE-2024-45201: LlamaIndex includes an exec call for `import {cls_name}`An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}. LlamaIndex 2024-08-22 03. CVE-2024-3271: llama-index-core Command Injection vulnerabilityA command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. LlamaIndex 2024-04-16