A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code. The vulnerability is a bypass of the previously addressed CVE-2023-39662, demonstrated through a proof of concept that creates a file on the system by exploiting the flaw.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2024-1326 | A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code. The vulnerability is a bypass of the previously addressed CVE-2023-39662, demonstrated through a proof of concept that creates a file on the system by exploiting the flaw. |
 Github GHSA |
GHSA-wvpx-g427-q9wc | llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published:
Updated: 2024-08-01T19:32:42.914Z
Reserved: 2024-03-29T17:32:52.425Z
Link: CVE-2024-3098
Vulnrichment
Updated: 2024-08-01T19:32:42.914Z
NVD
Status : Awaiting Analysis
Published: 2024-04-10T17:15:56.213
Modified: 2024-11-21T09:28:53.823
Link: CVE-2024-3098
Redhat
No data.
OpenCVE Enrichment
No data.