AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

LlamaIndexGHSA-pw38-xv9x-h8ch

RunGptLLM class in LlamaIndex has a command injection

LlamaIndex

CVE-2024-4181 · Published May 16, 2024 · updated Jul 13, 2026

High8.8
Fix: upgrade to 0.10.13 or later
GitHub advisory

A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect to Language Learning Models (LLMs). The vulnerability arises from the improper use of the eval function, allowing a malicious or compromised LLM hosting provider to execute arbitrary commands on the client's machine. This issue was fixed in version 0.10.13. The exploitation of this vulnerability could lead to a hosting provider gaining full control over client machines.

Affected versions

PackageAffectedFixed in
llama-index
PyPI
< 0.10.130.10.13
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-94
Also known as
CVE-2024-4181, PYSEC-2024-324, PYSEC-2026-1565

More LlamaIndex advisories

All LlamaIndex