CVE-2024-14021

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-14021

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-14021.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-14021

Aliases

PYSEC-2026-85

Published

2026-01-12T23:04:43.095Z

Modified

2026-07-08T06:27:17.045455457Z

Severity

8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

LlamaIndex <= 0.11.6 BGEM3Index Unsafe Deserialization

Details

LlamaIndex (run-llama/llamaindex) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.loadfromdisk() in llamaindex/indices/managed/bgem3/base.py. The function uses pickle.load() to deserialize multiembedstore.pkl from a user-supplied persistdir without validation. An attacker who can provide a crafted persist directory containing a malicious pickle file can trigger arbitrary code execution when the victim loads the index from disk.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-502"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/14xxx/CVE-2024-14021.json"
}

References

Affected packages

Git / github.com/run-llama/llama_index

Affected ranges

Type

GIT

Repo

https://github.com/run-llama/llama_index

Events

Introduced

Last affected

3c64a1b978c15f9349d5d20644feff50ae0f5849

Database specific

{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.11.6"
        }
    ],
    "cpe": "cpe:2.3:a:llamaindex:llamaindex:*:*:*:*:*:*:*:*"
}

Affected versions

v0.*

v0.10.0

v0.10.1

v0.10.10

v0.10.11

v0.10.12

v0.10.13

v0.10.13.post1

v0.10.14

v0.10.15

v0.10.16

v0.10.17

v0.10.18

v0.10.19

v0.10.20

v0.10.22

v0.10.23

v0.10.24

v0.10.25

v0.10.26

v0.10.27

v0.10.28

v0.10.28.post1

v0.10.29

v0.10.3

v0.10.30

v0.10.31

v0.10.32

v0.10.34

v0.10.35

v0.10.37

v0.10.38

v0.10.40

v0.10.41

v0.10.42

v0.10.43

v0.10.44

v0.10.47

v0.10.48

v0.10.48.post1

v0.10.49

v0.10.5

v0.10.50

v0.10.51

v0.10.52

v0.10.53

v0.10.54

v0.10.55

v0.10.57

v0.10.58

v0.10.59

v0.10.6

v0.10.60

v0.10.61

v0.10.62

v0.10.63

v0.10.66

v0.10.67

v0.10.67.post1

v0.10.68

v0.10.7

v0.10.8

v0.10.9

v0.11.0

v0.11.1

v0.11.2

v0.11.3

v0.11.4

v0.11.5

v0.11.6

v0.3.1

v0.4.0

v0.4.1

v0.4.2

v0.6.0

v0.6.0.alpha1

v0.6.21

v0.6.3

v0.7.10

v0.7.11

v0.7.11.post1

v0.7.12

v0.7.13

v0.7.14

v0.7.19

v0.7.20

v0.7.24.post1

v0.7.9

v0.8.1.post1

v0.8.10

v0.8.11.post1

v0.8.11.post2

v0.8.11.post3

v0.8.2

v0.8.2.post1

v0.8.25

v0.8.29.post1

v0.8.3

v0.8.38

v0.8.4

v0.8.43

v0.8.43.post1

v0.8.45

v0.8.45.post1

v0.8.5.post1

v0.8.53.post1

v0.8.63.post1

v0.8.66

v0.8.69

v0.8.69.post1

v0.8.69.post2

v0.8.7

v0.9.0

v0.9.1

v0.9.10

v0.9.11.post1

v0.9.12

v0.9.14.post3

v0.9.15

v0.9.15.post1

v0.9.15.post2

v0.9.16.post1

v0.9.17.dev1

v0.9.22

v0.9.25

v0.9.26

v0.9.28

v0.9.28.post1

v0.9.28.post2

v0.9.29

v0.9.3

v0.9.3.post1

v0.9.31

v0.9.36

v0.9.37

v0.9.38

v0.9.39

v0.9.40

v0.9.41

v0.9.42

v0.9.42.post1

v0.9.42.post2

v0.9.45.post1

v0.9.46

v0.9.48

v0.9.5

v0.9.6

v0.9.6.post1

v0.9.6.post2

v0.9.7

v0.9.8

v0.9.8.post1

v0.9.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-14021.json"