Free AI Safety Workshop — in collaboration with explainx.aiSave your seat
AgentbeamBeta
AI agent vulnerability · LlamaIndex

CVE-2024-4181: RunGptLLM class in LlamaIndex has a command injection

highCVSS 3.0 8.8GHSA-pw38-xv9x-h8ch

A command injection vulnerability exists in the RunGptLLM class of the llamaindex library, version 0.9.47, used by the RunGpt framework from JinaAI to connect to Language Learning Models (LLMs). The vulnerability arises from the improper use of the eval function, allowing a malicious or compromised LLM hosting provider to execute arbitrary commands on the client's machine. This issue was fixed in version 0.10.13.

Published May 16, 2024 · Updated May 24, 2024

Affected packages

llama-index

Ecosystem
PyPI
Affected
< 0.10.13
Fixed in
0.10.13
Check
pip show llama-index

llama-index-llms-rungpt

Ecosystem
PyPI
Affected
< 0.1.3
Fixed in
0.1.3
Check
pip show llama-index-llms-rungpt

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect to Language Learning Models (LLMs). The vulnerability arises from the improper use of the eval function, allowing a malicious or compromised LLM hosting provider to execute arbitrary commands on the client's machine. This issue was fixed in version 0.10.13. The exploitation of this vulnerability could lead to a hosting provider gaining full control over client machines.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More LlamaIndex vulnerabilities

All LlamaIndex entries