Vulnerability PYSEC-2026-85
High Risk
HIGH RISK
CVSS Score: 7.8
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
9 months ago
January 12, 2026 at 11:15 PM UTC
No summary available
0.4.4 - 0.11.6
0.4.4 - 0.11.6
Details
LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir without validation. An attacker who can provide a crafted persist directory containing a malicious pickle file can trigger arbitrary code execution when the victim loads the index from disk.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
3 months ago
LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class
0.4.4 - 0.12.40 PYSEC-2026-2606
0.4.4 - 0.12.40 PYSEC-2026-2606
High Risk
3 months ago
llama-index has Insecure Temporary File
0.4.4 - 0.12.52 PYSEC-2026-1556
0.4.4 - 0.12.52 PYSEC-2026-1556
High Risk
3 months ago
LlamaIndex Vulnerable to Denial of Service (DoS)
0.12.15 - 0.12.20 PYSEC-2026-1554
0.12.15 - 0.12.20 PYSEC-2026-1554
High Risk
3 months ago
LlamaIndex vulnerable to Creation of Temporary File in Directory with Insecure Permissions
0.4.4 - 0.12.2 PYSEC-2026-1555
0.4.4 - 0.12.2 PYSEC-2026-1555
Critical
3 months ago
llama_index vulnerable to SQL Injection
0.4.4 - 0.12.27 PYSEC-2026-394
0.4.4 - 0.12.27 PYSEC-2026-394
Impacted packages
Timeline
Published
9 months ago
January 12, 2026 at 11:15 PM UTC
Fixed (0.11.7)
2 years ago
September 07, 2024 at 01:06 AM UTC
Last Modified
5 months ago
May 20, 2026 at 09:19 AM UTC