LlamaIndexGHSA-wvpx-g427-q9wc
llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
Critical9.8CVE-2024-3098 · Published Apr 10, 2024 · updated Jun 29, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| llama-index-core PyPI | < 0.10.24 | 0.10.24 |
Details and references
A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code. The vulnerability is a bypass of the previously addressed CVE-2023-39662, demonstrated through a proof of concept that creates a file on the system by exploiting the flaw.
- CVSS 3.0
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-94
- Also known as
- CVE-2024-3098, PYSEC-2026-397
More LlamaIndex advisories
All LlamaIndex| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Apr 162024 | llama-index-core Command Injection vulnerability CVE-2024-3271Critical9.8fixed in 0.10.24 | Critical9.8 | 0.10.24 |
| May 162024 | RunGptLLM class in LlamaIndex has a command injection CVE-2024-4181High8.8fixed in 0.10.13 | High8.8 | 0.10.13 |
| Jan 222024 | SQL injection in llama-index CVE-2024-23751Critical9.8no fix yet | Critical9.8 | No fix yet |
| Aug 222024 | LlamaIndex includes an exec call for `import {cls_name}` CVE-2024-45201Critical9.8fixed in 0.10.38 | Critical9.8 | 0.10.38 |
| Aug 152023 | llama-index vulnerable to arbitrary code execution CVE-2023-39662Critical9.8fixed in 0.9.14 | Critical9.8 | 0.9.14 |
| Mar 202025 | LlamaIndex Improper Handling of Exceptional Conditions vulnerability CVE-2024-12704High7.5fixed in 0.12.6 | High7.5 | 0.12.6 |