Vulnerability · Published Jan 12, 2026 · Assigned by VulnCheck

CVE-2024-14021LlamaIndex <= 0.11.6 BGEM3Index Unsafe Deserialization

High 8.4

In plain English

A high-severity unsafe deserialization in llama_index from run-llama. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.4High

Exploit odds (30 days)0.3%top 72.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir without validation. An attacker who can provide a crafted persist directory containing a malicious pickle file can trigger arbitrary code execution when the victim loads the index from disk.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	llama-index	0.11.7	PYSEC-2026-85

Affected products (as reported)

Vendor	Product	Versions
run-llama	llama_index	0 – through 0.11.6

Weakness: CWE-502 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://huntr.com/bounties/ab4ceeb4-aa85-4d1c-aaca-4eda1b71fc12 technical-description, exploit
https://www.llamaindex.ai/ product
https://github.com/run-llama/llama_index third-party-advisory
https://www.vulncheck.com/advisories/llamaindex-bgem3index-unsafe-deserialization third-party-advisory