Week 45, updated 2 Nov 2026

RAG, knowledge & memory LlamaIndex

Is LlamaIndex safe?

Short answer: Caution. StackGrade's weekly scan of run-llama/llama_index gives it a Caution label for 39 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 256 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove LlamaIndex is exploitable in your setup. Automated scan of commit 619d746 on 2 Nov 2026, not a manual audit.

Updated : the last week its score, rank or safety result changed.

Framework for connecting LLMs to your documents and data (RAG).

  • 52,777 stars
  • pushed 26 Oct
  • MIT
  • Python

github.com/run-llama/llama_index · developers.llamaindex.ai

43score out of 100

#35of 52 overall#3in RAG, knowledge & memory▼ 2 vs Week 44

  • Maintenance 30%27
  • Adoption 30%42
  • Docs 20%69
  • Community 20%–
W42W43W44W45

Score over the last 4 weeks: 48, 41, 45, 43.

Caution

39 critical-severity known vulnerabilities in runtime dependencies (OSV).

How this score works

Each part is a percentile among all 52 tracked tools, so 50 is average for this list. Community is not measured yet; the score uses the other 80%.

  • Maintenance: Last push 26 Oct 2026. Last 10 GitHub releases within 215 days (about 1.3 per 30 days), latest release 21 Sept 2026. Median 29.1 h to close an issue (5 closed issues).
  • Adoption: 52,777 stars (70%), 8,495 forks (30%).
  • Docs: README 11,566 characters, 19 headings, 9 code blocks, install section: yes.

Methodology

#3 of 3 in RAG, knowledge & memory

Ranked by score. The yellow row is this tool.

RAG, knowledge & memory, Week 45score 0–100, safety
  1. 1RAGFlow#6 overall69Caution
  2. 2Mem0#21 overall55Caution
  3. 3LlamaIndex#35 overall43Caution

Safety scan, 2 Nov 2026

Automated scan of commit 619d746, 6,281 files. Not a manual audit.

Caution

  • 39Critical dependency advisories256 high, 189 medium, 30 low. OSV, runtime dependencies only.
  • 0Install hooksNo npm install scripts found.
  • 0Remote-code patternsFor example eval(fetch(…)).
  • 5Agent files checked0 phrases flagged for review.
  • 2curl | sh installersIn docs or program code. Information only.
Why this label?

Why this label:

  • 39 critical-severity known vulnerabilities in runtime dependencies (OSV)

Known vulnerabilities in runtime dependencies (OSV): 39 critical, 256 high, 189 medium, 30 low, 7 unrated

  • certifi@2026.7.22 (PYSEC-2026-4320) in llama-index-core/uv.lock
  • pillow@12.3.0 (PYSEC-2026-4330) in llama-index-core/uv.lock
  • pillow@12.3.0 (PYSEC-2026-4332) in llama-index-core/uv.lock
  • pillow@12.3.0 (PYSEC-2026-4339) in llama-index-core/uv.lock
  • pillow@12.3.0 (GHSA-332p-7hrc-92wf) in llama-index-core/uv.lock

Also found (informational, does not change the label):

  • 256 high-severity known vulnerabilities in runtime dependencies (OSV)
  • Documents curl|sh style installer (2 occurrences, e.g. docs/src/content/docs/framework/CONTRIBUTING.md)
  • Critical advisories counted once per package: 3747 matches across 612 lockfiles

Notes:

  • 5 affected packages only in dev/test/docs manifests, not counted
  • Telemetry/analytics references in code: telemetry

Automated scan of commit 619d746 on 2 Nov 2026, not a manual audit. 6,281 files checked. What we check

Repo activity

From the GitHub API, fetched 2 Nov 2026.

  • 2Releases, 90 daysLatest v0.14.25, 21 Sept
  • 29hMedian issue closeOver 5 closed issues
  • 52.8kStars+109 since 26 Oct
  • 8.5kForks1,180 open issues
  • 2022Repo created2 Nov 2022
30 days ago2 Nov
0 releases in the last 30 days, one mark each (GitHub releases feed, last 10 entries).

0 releases in the last 30 days (GitHub releases feed, last 10 entries).

Questions about LlamaIndex

Answers use this week's StackGrade data.

Is LlamaIndex safe to use?

Caution. StackGrade's weekly scan of run-llama/llama_index gives it a Caution label for 39 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 256 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove LlamaIndex is exploitable in your setup. Automated scan of commit 619d746 on 2 Nov 2026, not a manual audit.

How does StackGrade score LlamaIndex?

LlamaIndex scores 43 out of 100 in Week 45: #35 of 52 tracked tools overall and #3 in RAG, knowledge & memory. The score combines maintenance (27), adoption (42) and docs (69) as percentiles among all 52 tracked tools; community (20% weight) is not measured yet, so the score uses the other 80%. It is not a hands-on test and it is separate from the safety label.

What are the alternatives to LlamaIndex?

The highest-scored other tools in RAG, knowledge & memory this week: RAGFlow (69, Caution), Mem0 (55, Caution). StackGrade has not tested them hands-on.

What licence does LlamaIndex use?

The licence listed for run-llama/llama_index is MIT. Read the licence text before commercial use.

Compare and use it

All facts and sources
Type
Agent framework
License
MIT
Language
Python
Created
2 Nov 2022
Owner
run-llama (Organization)
Forks
8,495

GitHub description: “LlamaIndex is the document processing platform for AI”

Sources: github.com/run-llama/llama_index, api.github.com/repos/run-llama/llama_index, raw.githubusercontent.com/run-llama/llama_index/main/README.. Fetched 2 Nov 2026.

Know when LlamaIndex changes label

One email a week: the new top 10, the biggest score changes and every safety label that changed.

Free. Double opt-in: you confirm by email first, unsubscribe in one click.