CVE-2024-3098: critical vulnerability in run-llama/llama_index
Prompt Injection leading to Arbitrary Code Execution in run-llama/llama_index
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.8epss 1.0%
A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code. The vulnerability is a bypass of the previously addressed CVE-2023-39662, demonstrated through a proof of concept that creates a file on the system by exploiting the flaw.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
run-llama · run-llama/llama_indexRelated CVEs — run-llama/llama_index
In the same product, most dangerous first.
CVE-2024-3271CRITICALCommand Injection in run-llama/llama_indexEPSS 2.9%CVE-2024-4181HIGHCommand Injection in run-llama/llama_indexEPSS 2.1%CVE-2024-11958CRITICALSQL Injection in run-llama/llama_indexEPSS 1.4%CVE-2024-12909CRITICALSQL Injection to RCE in run-llama/llama_indexEPSS 1.4%CVE-2025-1753HIGHCommand Injection in LLama-Index CLI in run-llama/llama_indexEPSS 1.1%CVE-2025-1750CRITICALSQL Injection in run-llama/llama_indexEPSS 0.9%