PT-2026-53479 · Pypi · Llama Index

Published 2026-06-29 · Updated 2026-06-29

OSV

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Multiple vector store integrations in run-llama/llama index version v0.12.21 have SQL injection vulnerabilities. These vulnerabilities allow an attacker to read and write data using SQL, potentially leading to unauthorized access to data of other users depending on the usage of the llama-index library in a web application.

Fix

Related Identifiers

PYSEC-2026-394

Affected Products

Llama Index

References · 7

• https://osv.dev/vulnerability/PYSEC-2026-394 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1793 · Security Note
• https://github.com/run-llama/llama_index/commit/0008041e8dde8e519621388e5d6f558bde6ef42e · Note
• https://github.com/run-llama/llama_index · Note
• https://pypi.org/project/llama-index · Note
• https://github.com/advisories/GHSA-v3c8-3pr6-gr7p · Note
• https://huntr.com/bounties/8cb1555a-9655-4122-b0d6-60059e79183c · Note