CVE-2024-4181
- Source
- https://cve.org/CVERecord?id=CVE-2024-4181
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-4181.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-4181
- Aliases
- Published
- 2024-05-16T09:03:47Z
- Modified
- 2026-10-22T10:35:51Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Command Injection in run-llama/llama_index
- Details
-
A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect to Language Learning Models (LLMs). The vulnerability arises from the improper use of the eval function, allowing a malicious or compromised LLM hosting provider to execute arbitrary commands on the client's machine. This issue was fixed in version 0.10.13. The exploitation of this vulnerability could lead to a hosting provider gaining full control over client machines.
- Database specific
{ "cna_assigner": "@huntr_ai", "cwe_ids": [ "CWE-94" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4181.json" }- References
Affected packages
Git / github.com/run-llama/llama_index
Affected ranges
- Type
- GIT
- Repo
- https://github.com/run-llama/llama_index
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:llamaindex:llamaindex:*:*:*:*:*:*:*:*", "range": [ { "introduced": "0.9.47" }, { "fixed": "0.10.13" } ], "source": "CPE_RANGE" }, { "range": [ { "fixed": "d73715eaf0642705583e7897c78b9c8dd2d3a7ba" } ], "source": "REFERENCES_COMMIT" } ] }