{"action":"Upgrade llama-index to 0.11.7 or later.","affected":[{"fixed":"0.11.7","introduced":"0"}],"component":"llama-index","cve_ids":["CVE-2024-14021"],"ecosystem":"PyPI","epss":0.00337,"exploited":false,"fixed_versions":["0.11.7"],"id":"tcs_01M5KHDYC9XA0ZYJT3WWZA6J52","modified_at":"2026-05-20T09:19:05.259645Z","published_at":"2026-01-12T23:15:51.413Z","references":["https://osv.dev/vulnerability/PYSEC-2026-85","https://www.llamaindex.ai/","https://www.vulncheck.com/advisories/llamaindex-bgem3index-unsafe-deserialization","https://github.com/run-llama/llama_index","https://huntr.com/bounties/ab4ceeb4-aa85-4d1c-aaca-4eda1b71fc12"],"severity":{"label":"high","score":7.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-85","url":"https://osv.dev/vulnerability/PYSEC-2026-85"}],"summary":"LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The"}