CVE-2024-14021

HighCVSS 7.8

Published: 12/01/2026(UTC)Updated: 14/07/2026(UTC)Translated: 15/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile - higher than 21% of all known CVEs

Summary

LlamaIndex versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk(). The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir without validation, allowing an attacker to execute arbitrary code by providing a crafted pickle file.

Risk Assessment

An attacker can achieve remote code execution on the victim's server if they can trick the user into loading an index from a controlled persist_dir. This could lead to full system compromise, data theft, or lateral movement within the network.

Recommendation

Immediately upgrade LlamaIndex to version 0.11.7 or later, which contains a fix for this vulnerability. Until then, avoid loading indexes from untrusted sources.

Other vulnerabilities in LlamaIndex

CVE-2024-58339High
LlamaIndex versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. The custom_query() function generates SQL statements from user-supplied prompts and executes them via vn.run_sql() without enforcing query execution limits, allowing an attacker to trigger expensive SQL operations that exhaust CPU or memory resources.

Original NVD description (English source)

LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir without validation. An attacker who can provide a crafted persist directory containing a malicious pickle file can trigger arbitrary code execution when the victim loads the index from disk.