LiveActive security incident?Get immediate response
CVE Record

CVE-2024-14021: LlamaIndex <= 0.11.6 BGEM3Index Unsafe Deserialization

LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk() in llama_index/indices/managed/bge_m3/base.py. The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir without validation. An attacker who can provide a crafted persist directory containing a malicious pickle file can trigger arbitrary code execution when the victim loads the index from disk.

HighCVSS 8.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A malicious or untrusted saved BGEM3 index can run code when a user or service loads it. Successful exploitation could compromise the confidentiality, integrity, and availability of the affected system. The supplied record rates the issue high severity and describes LlamaIndex versions through 0.11.6 as affected.

Executive priority

Prioritize prompt investigation where AI applications import indexes from customers, partners, shared storage, uploads, or automated pipelines. Emergency handling is warranted if untrusted parties can influence persist_dir contents. Internally generated indexes with strongly restricted write access can follow risk-based remediation, but should still be inventoried and updated.

Technical view

BGEM3Index.load_from_disk() uses pickle.load() on multi_embed_store.pkl inside a user-supplied persist_dir without validation. Because Python pickle data can execute code during deserialization, loading an attacker-crafted index can produce arbitrary code execution with the victim process's privileges.

Likely exposure

Exposure requires LlamaIndex through 0.11.6, use of BGEM3Index.load_from_disk(), and a path by which an attacker can supply or modify the persisted index directory. Systems using trusted, access-controlled index files only have lower practical exposure, but filesystem and ingestion boundaries should be verified.

Exploitation context

The CVSS 4.0 vector indicates a local attack requiring victim interaction, with low complexity and high confidentiality, integrity, and availability impact. The bundle says this CVE is not in KEV and provides no evidence of active exploitation. A public technical report exists, so defenders should not treat the issue as undisclosed.

Researcher notes

The vulnerable sink and triggering file are specifically identified, but the bundle does not name a fixed version, official patch, or vendor mitigation. The affected metadata also contains an ambiguous version entry of "0", while the narrative states versions through 0.11.6. Confirm authoritative version ranges and remediation guidance before closing findings.

Mitigation direction

  • Identify deployments using LlamaIndex versions through 0.11.6 and BGEM3Index disk loading.
  • Prevent loading BGEM3 indexes from user-supplied, shared, or otherwise untrusted directories.
  • Restrict write access to persisted index directories and files.
  • Check current LlamaIndex vendor guidance for a fixed release or supported mitigation.
  • Isolate affected processes and minimize their filesystem, network, and credential privileges.

Validation and detection

  • Inventory installed LlamaIndex versions across development, automation, and production environments.
  • Search application code for BGEM3Index.load_from_disk() and trace each persist_dir source.
  • Verify persisted index directories cannot be written by untrusted users or ingestion workflows.
  • Review logs and file histories for unexpected multi_embed_store.pkl creation or modification.
  • Confirm upgrades or mitigations through non-malicious loading tests in an isolated environment.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-502: Code execution behavior lookup

Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-14021 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.4 (4.0)
Known Exploited
No
Published

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: noTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.4CVSS 4.0HighCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheck

Vulnerability scoring details

Base CVSS 4.0 score

8.4High
CVSS 4.0 vector shape for CVE-2024-14021Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
run-llamallama_index0unknown
Weakness

CWE details

CWE-502

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-502 · source CWE mapping

Deserialization of Untrusted Data

Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs