Vulnerabilities for llama-index-core

First version without a known vulnerability: 0.13.0

Details

• GHSA-488g-hw5f-x29p2026-02-02

  llama-index-core vulnerable to Uncontrolled Resource Consumption

  Fixed in: 0.12.41

• GHSA-cr7q-2w66-hjcm2025-09-27

  llama-index-core insecurely handles temporary files

  Fixed in: 0.13.0

• GHSA-7753-xrfw-ch362025-08-26

  LlamaIndex affected by a Denial of Service (DOS) in JSONReader

  Fixed in: 0.12.38

• GHSA-2rhq-96q8-4vjq2025-07-07

  LlamaIndex vulnerable to Path Traversal attack through its encode_image function

  Fixed in: 0.12.41

• GHSA-3wxx-q3gv-pvvv2025-07-07

  LlamaIndex vulnerable to DoS attack through uncontrolled recursive JSON parsing

  Fixed in: 0.12.38

• GHSA-m84c-4c34-28gf2025-07-07

  LlamaIndex has Incomplete Documentation of Program Execution related to JsonPickleSerializer component

  Fixed in: 0.12.41

• GHSA-j3wr-m6xh-64hg2025-03-20

  LlamaIndex Improper Handling of Exceptional Conditions vulnerability

  Fixed in: 0.12.6

• GHSA-fxc2-8m62-m85x2024-08-22

  LlamaIndex includes an exec call for `import {cls_name}`

  Fixed in: 0.10.38

• GHSA-r6gp-rff2-p3hf2024-04-16

  llama-index-core Command Injection vulnerability

  Fixed in: 0.10.24

• GHSA-wvpx-g427-q9wc2024-04-10

  llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution

  Fixed in: 0.10.24