CVE-2023-39662
published 2023-08-15CVE-2023-39662: An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function.
PriorityP353critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.23%
65.3th percentile
An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| llamaindex_project | llamaindex | <= 0.7.13 | — |
| run-llama | run-llama_llama_index | >= unspecified < 0.10.24 | 0.10.24 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ghsa9.8CRITICAL
osv9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
osv·2024-04-10·CVSS 9.8
CVE-2024-3098 [CRITICAL] llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code. The vulnerability is a bypass of the previously addressed CVE-2023-39662, demonstrated through a proof of concept that creates a file on the system by exploiting the flaw.
GHSA
llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
ghsa·2024-04-10·CVSS 9.8
CVE-2024-3098 [CRITICAL] CWE-94 llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code. The vulnerability is a bypass of the previously addressed CVE-2023-39662, demonstrated through a proof of concept that creates a file on the system by exploiting the flaw.
GHSA
llama-index vulnerable to arbitrary code execution
ghsa·2023-08-15
CVE-2023-39662 [CRITICAL] CWE-74 llama-index vulnerable to arbitrary code execution
llama-index vulnerable to arbitrary code execution
An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function.
OSV
CVE-2023-39662: An issue in llama_index v
osv·2023-08-15
CVE-2023-39662 CVE-2023-39662: An issue in llama_index v
An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function.
OSV
llama-index vulnerable to arbitrary code execution
osv·2023-08-15
CVE-2023-39662 [CRITICAL] llama-index vulnerable to arbitrary code execution
llama-index vulnerable to arbitrary code execution
An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function.
No detection rules found.
No public exploits indexed.
2023-08-15
Published