Skip to content
LLMHigh

CVE-2024-4181: A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version …

Occurred
May 16, 2024
Published
May 16, 2024
Source
NVD CVE

Summary

A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect to Language Learning Models (LLMs). The vulnerability arises from the improper use of the eval function, allowing a malicious or compromised LLM hosting provider to execute arbitrary commands on the client's machine. This issue was fixed in version 0.10.13. The exploitation of this vulnerability could lead to a hosting provider gaining full control over client machines.

Tags

  • CVE
  • CVE-2024-4181
  • cvss:HIGH

Classification

Category confidence: 90%
Severity confidence: 85%

Rationale: Command injection in LLM library allows arbitrary code execution by compromised hosting providers.

Classifier: Qwen/Qwen3.5-35B-A3B-FP8

Visit source