CVE-2024-3271

Advisory

Affected versions of the llama_index package are vulnerable to Command Injection due to insufficient validation in the safe_eval function within the exec_utils.py module. The safe_eval function's DunderVisitor class only checks for underscores in identifiers whilst permitting dangerous builtins like getattr and hasattr, which can be exploited to access restricted functionality and execute operating system commands.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-r6gp-rff2-p3hf
• https://github.com/run-llama/llama_index/commit/2c92e88838a5f481d50840240b1dd3180066c6f5
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3271