Vulnerability PYSEC-2026-394
Critical
CRITICAL RISK
CVSS Score: 9.8
Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
3 months ago
June 29, 2026 at 11:50 AM UTC
llama_index vulnerable to SQL Injection
0.4.4 - 0.12.27
0.4.4 - 0.12.27
Summary
llama_index vulnerable to SQL Injection
Details
Multiple vector store integrations in run-llama/llama_index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially leading to unauthorized access to data of other users depending on the usage of the llama-index library in a web application.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
3 months ago
LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class
0.4.4 - 0.12.40 PYSEC-2026-2606
0.4.4 - 0.12.40 PYSEC-2026-2606
High Risk
3 months ago
llama-index has Insecure Temporary File
0.4.4 - 0.12.52 PYSEC-2026-1556
0.4.4 - 0.12.52 PYSEC-2026-1556
High Risk
3 months ago
LlamaIndex Vulnerable to Denial of Service (DoS)
0.12.15 - 0.12.20 PYSEC-2026-1554
0.12.15 - 0.12.20 PYSEC-2026-1554
High Risk
3 months ago
LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions
0.4.4 - 0.12.2 PYSEC-2026-1555
0.4.4 - 0.12.2 PYSEC-2026-1555
High Risk
9 months ago
No summary available
0.4.4 - 0.11.6 PYSEC-2026-85
0.4.4 - 0.11.6 PYSEC-2026-85
Impacted packages
Timeline
Published
3 months ago
June 29, 2026 at 11:50 AM UTC
Fixed (0.12.28)
1 year ago
April 02, 2025 at 02:05 AM UTC
Last Modified
3 months ago
July 01, 2026 at 08:22 PM UTC