Executive brief
LlamaIndex includes an exec call for `import {cls_name}`
Affected products
- PyPI llama-index
- PyPI llama-index-core
Junglewise Threat Intelligence
CVE-2024-45201: PYSEC-2026-395 - LlamaIndex includes an exec call for `import {cls_name}`
CVE-2024-45201 · Severity: low · CVSS 3.1 · Published 2026-06-29
Technologies: llama-index (PyPI), llama-index-core (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2606 - LlamaIndex vulnerable to data loss through hash collisions in its DocugamiReader class
- PYSEC-2026-1560 - llama-index-core vulnerable to Uncontrolled Resource Consumption
- PYSEC-2026-1556 - llama-index has Insecure Temporary File
- PYSEC-2026-1562 - llama-index-core insecurely handles temporary files
- PYSEC-2026-1561 - LlamaIndex affected by a Denial of Service (DOS) in JSONReader