llama-index-pickle-mfv-poc

⚠️ Security Vulnerability PoC — Do Not Use in Production

This repository contains a proof-of-concept malicious pickle file created solely to demonstrate a responsibly-disclosed vulnerability in the llama_index project, submitted via huntr's Model File Vulnerability (MFV) program.

What this file is

multi_embed_store.pkl is a standard Python pickle stream containing a single object whose class defines __reduce__ to invoke os.system(...) during deserialization. This demonstrates that any application calling pickle.load() on an untrusted file without a restricted Unpickler allowlist is vulnerable to arbitrary code execution (CWE-502).

The embedded payload is intentionally non-destructive: it only appends a single timestamped line to /tmp/huntr_mfv_pickle_poc.txt to prove code execution occurred (whoami/hostname/timestamp) - it does not exfiltrate, delete, or modify anything else.

Affected components

• llama-index-indices-managed-bge-m3 — BGEM3Index.load_from_disk()
• llama-index-vector-stores-txtai — TxtaiVectorStore.from_persist_path()

Both call pickle.load() directly on a file from a caller-supplied "persist directory" with no restriction on which classes may be reconstructed.

Do not

• Do not load this file with plain pickle.load() unless you understand exactly what it does and are doing so intentionally to reproduce the reported vulnerability.
• Do not use this as a real embedding store / vector store checkpoint.

Contact

Filed as part of responsible disclosure. See the corresponding huntr MFV report for full reproduction steps and impact analysis.