run-llama/llama_index · Security
LlamaIndex includes an exec call for `import {cls_name}`
- GHSA ID
- GHSA-fxc2-8m62-m85x
- CVE ID
- CVE-2024-45201
- Severity
- critical
- Published
- Updated
- CVSS
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 9.8 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS v4
- 9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}.
CWEs
- CWE-94 · Improper Control of Generation of Code ('Code Injection')
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-45201 ↗
- https://github.com/run-llama/llama_index/pull/13523 ↗
- https://github.com/run-llama/llama_index/compare/v0.10.37...v0.10.38 ↗
- https://github.com/run-llama/llama_index/commit/bd827c30484fa085ec769fa55dc7f2add8006ac8 ↗
- https://github.com/pypa/advisory-database/tree/main/vulns/llama-index/PYSEC-2024-192.yaml ↗
- https://github.com/advisories/GHSA-fxc2-8m62-m85x ↗