CVE-2024-3098: fallo crítico en run-llama/llama_index
Prompt Injection leading to Arbitrary Code Execution in run-llama/llama_index
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.8epss 1.0%
A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code. The vulnerability is a bypass of the previously addressed CVE-2023-39662, demonstrated through a proof of concept that creates a file on the system by exploiting the flaw.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
run-llama · run-llama/llama_indexCVEs relacionadas — run-llama/llama_index
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-3271CRITICALCommand Injection in run-llama/llama_indexEPSS 2.9%CVE-2024-4181HIGHCommand Injection in run-llama/llama_indexEPSS 2.1%CVE-2024-11958CRITICALSQL Injection in run-llama/llama_indexEPSS 1.4%CVE-2024-12909CRITICALSQL Injection to RCE in run-llama/llama_indexEPSS 1.4%CVE-2025-1753HIGHCommand Injection in LLama-Index CLI in run-llama/llama_indexEPSS 1.1%CVE-2025-1750CRITICALSQL Injection in run-llama/llama_indexEPSS 0.9%