CVE-2024-34359

Advisory

Llama-cpp-python version 0.2.72 addresses a security issue by fixing a Remote Code Execution vulnerability caused by Server-Side Template Injection in Model Metadata.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- fix(security): Remote Code Execution by Server-Side Template Injection in Model Metadata by retr0reg in b454f40a9a1787b2b5659cd2cb00819d983185df
- fix(security): Update remaining jinja chat templates to use immutable sandbox by CISC in 1441

Resources

• https://pypi.org/project/llama-cpp-python
• https://data.safetycli.com/changelogs/llama-cpp-python/
• https://github.com/abetlen/llama-cpp-python/commit/561e880654aa4e1311b22577e9149962be0d8ba0
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34359