CVE-2024-14021

Katalog CVE

CVSS 7.8 · High EPSS 0,34%

Kerentanan Deserialization of Untrusted Data pada llamaindex. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir without validation. An attacker who can provide a crafted persist directory containing a malicious pickle file can trigger arbitrary code execution when the victim loads the index from disk.

Rincian

Terbit di NVD

12 Januari 2026

Terakhir diubah

14 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,34% peluang dieksploitasi; lebih tinggi dari 25,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://huntr.com/bounties/ab4ceeb4-aa85-4d1c-aaca-4eda1b71fc12 exploit · advisory pihak ketiga
• https://www.vulncheck.com/advisories/llamaindex-bgem3index-unsafe-deserialization advisory pihak ketiga
• https://github.com/run-llama/llama_index product
• https://www.llamaindex.ai/ product