Executive brief
llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
Affected products
- PyPI llama-index-core
Junglewise Threat Intelligence
CVE-2024-3098: PYSEC-2026-397 - llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
CVE-2024-3098 · Severity: low · CVSS 3 · Published 2026-06-29
Technologies: llama-index-core (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1560 - llama-index-core vulnerable to Uncontrolled Resource Consumption
- PYSEC-2026-1562 - llama-index-core insecurely handles temporary files
- PYSEC-2026-1561 - LlamaIndex affected by a Denial of Service (DOS) in JSONReader
- PYSEC-2026-1558 - LlamaIndex vulnerable to Path Traversal attack through its encode_image function
- PYSEC-2026-1559 - LlamaIndex vulnerable to DoS attack through uncontrolled recursive JSON parsing