{"action":"Upgrade llama-index to 0.12.3 or later.","affected":[{"fixed":"0.12.3","introduced":"0"}],"component":"llama-index","cve_ids":["CVE-2024-58339"],"ecosystem":"PyPI","epss":0.00649,"exploited":false,"fixed_versions":["0.12.3"],"id":"tcs_01M5KHE0BDYFHRT4W58BDGHWCM","modified_at":"2026-05-20T09:19:05.331978Z","published_at":"2026-01-12T23:15:51.630Z","references":["https://osv.dev/vulnerability/PYSEC-2026-86","https://www.llamaindex.ai/","https://www.vulncheck.com/advisories/llamaindex-vannaqueryengine-sql-execution-allows-resource-exhaustion","https://github.com/run-llama/llama_index","https://huntr.com/bounties/a1d6c30d-fce0-412a-bd22-14e0d4c1fa1f"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-86","url":"https://osv.dev/vulnerability/PYSEC-2026-86"}],"summary":"LlamaIndex (run-llama/llama_index) versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. The custom_query() l"}