CVE-2024-4181
May 16, 2024, 1:03 p.m.
Tags
CVSS Score
Product(s) Impacted
llama_index library
- 0.9.47
RunGpt framework from JinaAI
- 0.9.47
- 0.10.13
Description
A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect to Language Learning Models (LLMs). The vulnerability arises from the improper use of the eval function, allowing a malicious or compromised LLM hosting provider to execute arbitrary commands on the client's machine. This issue was fixed in version 0.10.13. The exploitation of this vulnerability could lead to a hosting provider gaining full control over client machines.
Weaknesses
Date
Published: May 16, 2024, 9:15 a.m.
Last Modified: May 16, 2024, 1:03 p.m.
Status : Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.
More infoSource
security@huntr.dev
CVSS Data
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Base Score
Exploitability Score
Impact Score
Base Severity
HIGHCVSS Vector String
The CVSS vector string provides an in-depth view of the vulnerability metrics.
View Vector StringCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H