RunGptLLM class in LlamaIndex has a command injection

🗓️ 16 May 2024 09:08:33Reported by GitHub Advisory DatabaseType

Command injection in RunGptLLM class of LlamaIndex library v0.9.47, fixed in v0.10.13

Reporter	Title	Published	Views	Family All 6
NVD	CVE-2024-4181	16 May 202409:15	–	nvd
Veracode	Command Injection	29 May 202407:34	–	veracode
Vulnrichment	CVE-2024-4181 Command Injection in run-llama/llama_index	16 May 202409:03	–	vulnrichment
OSV	RunGptLLM class in LlamaIndex has a command injection	16 May 202409:33	–	osv
Cvelist	CVE-2024-4181 Command Injection in run-llama/llama_index	16 May 202409:03	–	cvelist
CVE	CVE-2024-4181	16 May 202409:15	–	cve

Vulners

Node

-llama-index-llms-rungptRange<0.1.3

-llama-indexRange<0.10.13

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-4181
github	www.github.com/run-llama/llama_index/commit/d73715eaf0642705583e7897c78b9c8dd2d3a7ba
huntr	www.huntr.com/bounties/1a204520-598a-434e-b13d-0d34f2a5ddc1
github	www.github.com/advisories/GHSA-pw38-xv9x-h8ch

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo