llama-index 0.9.4 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the llama-index package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Expected Behavior Violation llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Expected Behavior Violation via the `DocugamiReader` class. An attacker can cause loss of important document content, disrupt parent-child chunk hierarchies, and lead to inaccurate AI outputs by exploiting hash collisions that result in overwriting structurally distinct document chunks containing identical text. How to fix Expected Behavior Violation? Upgrade `llama-index` to version 0.12.41 or higher.	[,0.12.41)
C Arbitrary File Write via Archive Extraction (Zip Slip) llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) via the `encode_image` function. An attacker can access arbitrary files on the server by supplying crafted `image_path` values containing path traversal sequences. How to fix Arbitrary File Write via Archive Extraction (Zip Slip)? Upgrade `llama-index` to version 0.12.41 or higher.	[,0.12.41)
H Deserialization of Untrusted Data llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the `JsonPickleSerializer` process. An attacker can execute arbitrary code by submitting specially crafted serialized data that triggers the insecure fallback to Python's pickle module. How to fix Deserialization of Untrusted Data? Upgrade `llama-index` to version 0.12.41 or higher.	[,0.12.41)
H Uncontrolled Recursion llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Uncontrolled Recursion via the `JSONReader` process. An attacker can cause the application to crash by submitting deeply nested JSON structures, resulting in a stack overflow and service disruption. How to fix Uncontrolled Recursion? Upgrade `llama-index` to version 0.12.38 or higher.	[,0.12.38)
M Directory Traversal llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Directory Traversal via the `load_data` method in the `ObsidianReader` class. An attacker can access sensitive system files by exploiting hardlinks to bypass path restrictions. How to fix Directory Traversal? Upgrade `llama-index` to version 0.12.41 or higher.	[,0.12.41)
H Directory Traversal llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Directory Traversal via the `ObsidianReader` process. An attacker can access arbitrary files outside the intended directory by creating symbolic links that point to sensitive files, which are then processed as valid Markdown files. How to fix Directory Traversal? Upgrade `llama-index` to version 0.12.28 or higher.	[,0.12.28)
M Expected Behavior Violation llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Expected Behavior Violation via the `ArxivReader` process. An attacker can cause data loss by uploading papers with identical titles but different contents, resulting in one paper overwriting another due to MD5 hash collisions during filename generation. How to fix Expected Behavior Violation? Upgrade `llama-index` to version 0.12.28 or higher.	[,0.12.28)
H Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') via the `parse_sitemap ()` function. An attacker can exhaust system memory and potentially cause a system crash by supplying a specially crafted XML file containing excessive entity expansions. How to fix Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')? Upgrade `llama-index` to version 0.12.29 or higher.	[,0.12.29)
H Improper Control of Generation of Code ('Code Injection') llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') through the `exec` call in the `download/integration.py` script. An attacker can execute arbitrary code by injecting malicious input into the `cls_name` variable used in the exec call. How to fix Improper Control of Generation of Code ('Code Injection')? Upgrade `llama-index` to version 0.10.38 or higher.	[,0.10.38)
C Command Injection llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Command Injection due to the `safe_eval` function. An attacker can execute arbitrary code on the server hosting the application by crafting input that, while not containing an underscore, still results in the execution of OS commands. How to fix Command Injection? Upgrade `llama-index` to version 0.10.24 or higher.	[,0.10.24)
H Arbitrary Code Execution llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Arbitrary Code Execution via the `exec` parameter in `PandasQueryEngine` function due to missing input sanitization. How to fix Arbitrary Code Execution? Upgrade `llama-index` to version 0.9.5 or higher.	[,0.9.5)

Vulnerability

Vulnerable Version

Expected Behavior Violation