HIGH7.5PyPI
GHSA-2rhq-96q8-4vjq· CVE-2025-6209, PYSEC-2025-65LlamaIndex vulnerable to Path Traversal attack through its encode_image function
Modified: 7/7/2026
package
PyPI/llama-index-core
pkg:pypi/llama-index-core
MEDIUM6.5PyPI
GHSA-3wxx-q3gv-pvvv· CVE-2025-5472, PYSEC-2025-251LlamaIndex vulnerable to DoS attack through uncontrolled recursive JSON parsing
Modified: 7/13/2026
MEDIUM5.3PyPI
GHSA-488g-hw5f-x29p· CVE-2025-6208, PYSEC-2026-1560llama-index-core vulnerable to Uncontrolled Resource Consumption
Modified: 7/7/2026
HIGH8.6PyPI
GHSA-7753-xrfw-ch36· CVE-2025-5302, PYSEC-2026-1561LlamaIndex affected by a Denial of Service (DOS) in JSONReader
Modified: 7/7/2026
HIGH7.3PyPI
GHSA-cr7q-2w66-hjcm· CVE-2025-7647, PYSEC-2026-1562llama-index-core insecurely handles temporary files
Modified: 9/10/2026
CRITICAL9.8PyPI
GHSA-fxc2-8m62-m85x· CVE-2024-45201, PYSEC-2024-192LlamaIndex includes an exec call for `import {cls_name}`
Modified: 6/29/2026
HIGH7.5PyPI
GHSA-j3wr-m6xh-64hg· CVE-2024-12704, PYSEC-2025-244LlamaIndex Improper Handling of Exceptional Conditions vulnerability
Modified: 7/13/2026
MEDIUM5.0PyPI
GHSA-m84c-4c34-28gf· CVE-2025-3108, PYSEC-2025-249LlamaIndex has Incomplete Documentation of Program Execution related to JsonPickleSerializer component
Modified: 7/13/2026
CRITICAL9.8PyPI
GHSA-r6gp-rff2-p3hf· CVE-2024-3271, PYSEC-2026-396llama-index-core Command Injection vulnerability
Modified: 6/29/2026
CRITICAL9.8PyPI
GHSA-wvpx-g427-q9wc· CVE-2024-3098, PYSEC-2026-397llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
Modified: 6/29/2026
HIGH7.5PyPI
PYSEC-2026-1558· CVE-2025-6209, GHSA-2rhq-96q8-4vjqLlamaIndex vulnerable to Path Traversal attack through its encode_image function
Modified: 7/7/2026
MEDIUM6.5PyPI
PYSEC-2026-1559· CVE-2025-5472, GHSA-3wxx-q3gv-pvvvLlamaIndex vulnerable to DoS attack through uncontrolled recursive JSON parsing
Modified: 7/13/2026
MEDIUM5.3PyPI
PYSEC-2026-1560· CVE-2025-6208, GHSA-488g-hw5f-x29pllama-index-core vulnerable to Uncontrolled Resource Consumption
Modified: 7/7/2026
HIGH8.6PyPI
PYSEC-2026-1561· CVE-2025-5302, GHSA-7753-xrfw-ch36LlamaIndex affected by a Denial of Service (DOS) in JSONReader
Modified: 7/7/2026
HIGH7.3PyPI
PYSEC-2026-1562· CVE-2025-7647, GHSA-cr7q-2w66-hjcmllama-index-core insecurely handles temporary files
Modified: 7/7/2026
HIGH7.5PyPI
PYSEC-2026-1563· CVE-2024-12704, GHSA-j3wr-m6xh-64hgLlamaIndex Improper Handling of Exceptional Conditions vulnerability
Modified: 7/13/2026
MEDIUM5.0PyPI
PYSEC-2026-1564· CVE-2025-3108, GHSA-m84c-4c34-28gfLlamaIndex has Incomplete Documentation of Program Execution related to JsonPickleSerializer component
Modified: 7/13/2026
CRITICAL9.8PyPI
PYSEC-2026-395· CVE-2024-45201, GHSA-fxc2-8m62-m85xLlamaIndex includes an exec call for `import {cls_name}`
Modified: 7/1/2026
CRITICAL9.8PyPI
PYSEC-2026-396· CVE-2024-3271, GHSA-r6gp-rff2-p3hfllama-index-core Command Injection vulnerability
Modified: 7/1/2026
CRITICAL9.8PyPI
PYSEC-2026-397· CVE-2024-3098, GHSA-wvpx-g427-q9wcllama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
Modified: 7/1/2026