Advisories
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
Security vulnerabilities, privacy incidents, safety concerns, and policy updates affecting LLMs and AI agents.
12 items
LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation, tracked as CVE-2024-58339. The custom_query() function generates SQL from a user-supplied prompt and runs it through vn.run_sql() without enforcing query execution limits, so in deployments where untrusted users can supply prompts, an attacker can trigger expensive or unbounded SQL operations that exhaust CPU or memory and cause a denial-of-service condition.
The llama_index library, version 0.12.33, sets the NLTK data directory to a subdirectory of the codebase by default. In multi-user environments that directory is world-writable, so local users can overwrite, delete, or corrupt NLTK data files. The source describes this as a shared cache directory used instead of a user-specific one.
A denial of service flaw exists in the JSONReader component of the run-llama/llama_index repository, in version v0.12.37. Parsing deeply nested JSON files triggers uncontrolled recursion, which can push Python past its maximum recursion depth limit, causing high resource consumption and potential crashes of the Python process.
Fix: The issue is resolved in version 0.12.38.
GitHub Advisory DatabaseThe DocugamiReader class in run-llama/llama_index, in versions up to but excluding 0.12.41, generates chunk IDs with MD5 hashing. Structurally distinct chunks that contain identical text collide, so one chunk overwrites another. This can lose important document content, break parent-child chunk hierarchies, and produce inaccurate AI responses.
Fix: The issue is resolved in version 0.3.1.
A path traversal flaw in the `encode_image` function in `generic_utils.py` affects run-llama/llama_index versions 0.11.23 through 0.12.40. An attacker who controls the `image_path` input can use traversal sequences to read arbitrary files on the server, including sensitive system files, because the file path is not properly validated or sanitized.
Fix: Fixed in 0.12.41.
GitHub Advisory DatabaseThe JSONReader in run-llama/llama_index version 0.12.28 is vulnerable to a stack overflow caused by uncontrolled recursive JSON parsing. An attacker can submit deeply nested JSON structures to trigger a RecursionError, crashing the application and causing a Denial of Service.
Fix: The issue is resolved in version 0.12.38.
GitHub Advisory DatabaseThe run-llama/llama_index library's JsonPickleSerializer component, in versions v0.12.27 through v0.12.40, falls back to Python's pickle module. Its deserialization calls pickle.loads(), so processing untrusted data can execute arbitrary code, and attackers can craft malicious payloads to achieve full system compromise. The root cause is an insecure fallback strategy without sufficient input validation or protective safeguards.
Version 0.12.41 renames JsonPickleSerializer to PickleSerializer and adds a warning to the docs to only use PickleSerializer to deserialize safe things.
A Denial of Service vulnerability affects the KnowledgeBaseWebReader class in the run-llama/llama_index project, reported against version ~ latest(v0.12.15). The flaw stems from the max_depth parameter not being properly enforced in the get_article_urls function. An attacker can exhaust Python's recursion limit through repeated function calls, consuming resources and crashing the Python process.
A flaw in the KnowledgeBaseWebReader class of the run-llama/llama_index repository, version latest, lets an attacker control a URL variable so that it contains the root URL. This triggers infinite recursive calls to the get_article_urls method, which exhausts system resources and can crash the application, resulting in a Denial of Service.
CVE-2024-12911 is a vulnerability in the `default_jsonalyzer` function of the `JSONalyzeQueryEngine` in the run-llama/llama_index repository. It allows SQL injection via prompt injection, which can lead to arbitrary file creation and Denial-of-Service (DoS) attacks. The vulnerability affects the latest version and is fixed in version 0.5.1.
Fix: Fixed in version 0.5.1.
NVD/CVE DatabaseAn issue in llama_index before 0.10.38 affects download/integration.py. The file contains an exec call for `import {cls_name}`, so the class name is interpolated into code that is executed.
A flaw in the `safe_eval` function of the `exec_utils` class in the `llama_index` package allows prompt injection to lead to arbitrary code execution. Insufficient input validation lets an attacker bypass method restrictions and run unauthorized code. It bypasses the previously addressed CVE-2023-39662, and a proof of concept creates a file on the system.