CVE-2024-14021: LlamaIndex Unsafe Deserialization RCE Flaw

CVE-2024-14021 Overview

CVE-2024-14021 is an unsafe deserialization vulnerability in LlamaIndex (run-llama/llama_index) versions up to and including 0.11.6. The flaw resides in the BGEM3Index.load_from_disk() function within llama_index/indices/managed/bge_m3/base.py. The function calls pickle.load() on multi_embed_store.pkl from a user-supplied persist_dir without validation. An attacker who controls the persist directory can embed a malicious pickle file that executes arbitrary code when the victim loads the index. The issue is tracked as [CWE-502: Deserialization of Untrusted Data].

Critical Impact

Loading a crafted persist directory triggers arbitrary code execution in the context of the Python process running LlamaIndex.

Affected Products

• LlamaIndex run-llama/llama_index versions up to and including 0.11.6
• The BGEM3Index managed index component (llama_index/indices/managed/bge_m3/base.py)
• Downstream retrieval-augmented generation (RAG) applications embedding the vulnerable index class

Discovery Timeline

• 2026-01-12 - CVE-2024-14021 published to NVD
• 2026-07-14 - Last updated in NVD database

Technical Details for CVE-2024-14021

Vulnerability Analysis

The BGEM3Index class persists its multi-vector embedding store as a Python pickle file. When an application calls BGEM3Index.load_from_disk(persist_dir=...), the loader opens multi_embed_store.pkl from that directory and passes the byte stream to pickle.load(). Python's pickle format supports arbitrary object reconstruction through the __reduce__ protocol, which permits execution of any callable during deserialization. Because the loader performs no signature verification, no schema validation, and no source-of-origin checks, any attacker who can influence the persist directory contents can achieve code execution in the host process.

Root Cause

The root cause is trust placed in an on-disk artifact that is treated as code rather than data. The pickle module is documented as unsafe for untrusted input, yet BGEM3Index.load_from_disk() uses it as the primary loading mechanism. See the VulnCheck Advisory: LlamaIndex Deserialization for the technical write-up.

Attack Vector

Exploitation requires the victim to load a persist directory supplied by the attacker. Realistic delivery paths include shared model registries, community-published index bundles, cloud storage buckets writable by low-privilege users, and CI pipelines that fetch indexes from external sources. The attack requires user action (the load call) but no authentication on the LlamaIndex process itself. Successful exploitation yields code execution with full confidentiality, integrity, and availability impact on the local host.

No public proof-of-concept exploit is available. A minimal attacker workflow would craft a pickle payload whose __reduce__ method returns a call to os.system or subprocess.Popen, write it as multi_embed_store.pkl inside a directory that mimics a legitimate persist layout, and stage it where the victim application performs BGEM3Index.load_from_disk().

Detection Methods for CVE-2024-14021

Indicators of Compromise

• Unexpected multi_embed_store.pkl files in persist directories sourced from third parties or writable shares.
• Python processes hosting LlamaIndex spawning shells, curl, wget, or python -c child processes shortly after index load.
• Outbound network connections initiated from Python worker processes to previously unseen infrastructure immediately after RAG initialization.

Detection Strategies

• Statically scan repositories and object storage for pickle files inside LlamaIndex persist directories and flag those not produced by trusted pipelines.
• Instrument application startup to log the resolved persist_dir path and file hashes for every load_from_disk() call.
• Alert on process-lineage anomalies where a Python interpreter running LlamaIndex spawns command interpreters or network utilities.

Monitoring Recommendations

• Baseline the expected child-process tree of RAG services and alert on deviations.
• Monitor filesystem writes to directories consumed by BGEM3Index.load_from_disk() and treat unauthorized modifications as high severity.
• Capture and retain EDR telemetry for the Python runtime, including module load events for pickle and network egress from AI service accounts.

How to Mitigate CVE-2024-14021

Immediate Actions Required

• Inventory all applications importing llama_index.indices.managed.bge_m3 and identify their persist directory sources.
• Restrict write access to any directory consumed by BGEM3Index.load_from_disk() to trusted service identities only.
• Refuse to load persist directories obtained from untrusted registries, user uploads, or shared buckets until the version is upgraded and integrity controls are in place.

Patch Information

At the time of the NVD entry, no fixed version is enumerated in the advisory metadata; versions up to and including 0.11.6 are listed as affected. Track the upstream GitHub Project Repository and the Huntr Bug Bounty Listing for the remediation commit, and upgrade to the first release that replaces pickle.load() with a safe serialization format.

Workarounds

• Avoid BGEM3Index entirely and use index classes that persist state in JSON, Parquet, or other non-executable formats.
• Wrap load_from_disk() calls with an integrity check that verifies a signed hash of multi_embed_store.pkl against a manifest produced by a trusted builder.
• Run LlamaIndex workloads under a least-privilege service account inside a sandbox or container with no outbound network access and read-only filesystem mounts outside the working directory.

# Configuration example: restrict persist directory to a trusted, read-only mount
chown -R llamaindex:llamaindex /opt/rag/persist
chmod -R 0500 /opt/rag/persist
mount -o remount,ro /opt/rag/persist