CVE-2024-14021 - LlamaIndex <= 0.11.6 bgem3index unsafe deserialization - Guide

CVE ID : CVE-2024-14021 Published : Jan. 12, 2026, 11:15 p.m. | 1 hour, 35 minutes ago Description : LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir without validation. An attacker who can provide a crafted persist directory containing a malicious pickle file can trigger arbitrary code execution when the victim loads the index from disk. Severity: 8.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Source: Telegram CVE Monitor