# cve.now: Run-llama

The newest entries naming Run-llama as an affected vendor (up to 200), of 26 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2025-6208](https://cve.now/CVE-2025-6208.md): Uncontrolled Memory Consumption in run-llama/llama\_index (CVSS 5.3)
- [CVE-2024-14021](https://cve.now/CVE-2024-14021.md): LlamaIndex \<= 0.11.6 BGEM3Index Unsafe Deserialization (CVSS 8.4)
- [CVE-2024-58339](https://cve.now/CVE-2024-58339.md): LlamaIndex \<= 0.12.2 VannaQueryEngine SQL Execution Allows Resource Exhaustion (CVSS 8.7)
- [CVE-2025-7707](https://cve.now/CVE-2025-7707.md): World-Writable NLTK Cache Directory Vulnerability in run-llama/llama\_index (CVSS 7.1)
- [CVE-2025-7647](https://cve.now/CVE-2025-7647.md): Insecure Temporary File Handling in run-llama/llama\_index (CVSS 7.3)
- [CVE-2025-5302](https://cve.now/CVE-2025-5302.md): Denial of Service (DOS) in JSONReader in run-llama/llama\_index (CVSS 8.6)
- [CVE-2025-6211](https://cve.now/CVE-2025-6211.md): MD5 Hash Collision in run-llama/llama\_index (CVSS 6.5)
- [CVE-2025-6209](https://cve.now/CVE-2025-6209.md): Arbitrary File Read through Path Traversal in run-llama/llama\_index (CVSS 7.5)
- [CVE-2025-5472](https://cve.now/CVE-2025-5472.md): Denial of Service via Uncontrolled Recursive JSON Parsing in JSONReader in run-llama/llama\_index (CVSS 6.5)
- [CVE-2025-6210](https://cve.now/CVE-2025-6210.md): Hardlink-Based Path Traversal in run-llama/llama\_index (CVSS 6.2)
- [CVE-2025-3046](https://cve.now/CVE-2025-3046.md): Path Traversal via Symbolic Links in run-llama/llama\_index (CVSS 7.5)
- [CVE-2025-3044](https://cve.now/CVE-2025-3044.md): MD5 Hash Collision in run-llama/llama\_index (CVSS 5.3)
- [CVE-2025-3225](https://cve.now/CVE-2025-3225.md): XML Entity Expansion vulnerability in run-llama/llama\_index (CVSS 7.5)
- [CVE-2025-3108](https://cve.now/CVE-2025-3108.md): Unsafe Deserialization in JsonPickleSerializer Enables Remote Code Execution in run-llama/llama\_index (CVSS 5.0)
- [CVE-2025-1793](https://cve.now/CVE-2025-1793.md): SQL Injection in run-llama/llama\_index (CVSS 9.8)
- [CVE-2025-1750](https://cve.now/CVE-2025-1750.md): SQL Injection in run-llama/llama\_index (CVSS 9.8)
- [CVE-2025-1753](https://cve.now/CVE-2025-1753.md): Command Injection in LLama-Index CLI in run-llama/llama\_index (CVSS 7.8)
- [CVE-2025-1752](https://cve.now/CVE-2025-1752.md): Denial of Service in run-llama/llama\_index (CVSS 7.5)
- [CVE-2024-11958](https://cve.now/CVE-2024-11958.md): SQL Injection in run-llama/llama\_index (CVSS 9.8)
- [CVE-2024-12911](https://cve.now/CVE-2024-12911.md): SQL Injection in run-llama/llama\_index (CVSS 7.1)
- [CVE-2024-12909](https://cve.now/CVE-2024-12909.md): SQL Injection to RCE in run-llama/llama\_index (CVSS 10.0)
- [CVE-2024-12910](https://cve.now/CVE-2024-12910.md): Denial of Service in run-llama/llama\_index (CVSS 4.2)
- [CVE-2024-12704](https://cve.now/CVE-2024-12704.md): Denial of Service (DoS) in run-llama/llama\_index (CVSS 7.5)
- [CVE-2024-4181](https://cve.now/CVE-2024-4181.md): Command Injection in run-llama/llama\_index (CVSS 8.8)
- [CVE-2024-3271](https://cve.now/CVE-2024-3271.md): Command Injection in run-llama/llama\_index (CVSS 9.8)
- [CVE-2024-3098](https://cve.now/CVE-2024-3098.md): Prompt Injection leading to Arbitrary Code Execution in run-llama/llama\_index (CVSS 9.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/run-llama
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.