PT-2023-27061

🗓️ 15 Aug 2023 00:00:00Reported by Positive TechnologiesType

ptsecurity

ptsecurity🔗 dbugs.ptsecurity.com👁 2 Views

Llama index up to 0.7.13 is vulnerable to remote code execution via the exec parameter in PandasQueryEngine.

Reporter	Title	Published	Views	Family All 16
ATTACKERKB	CVE-2023-39662	15 Aug 202317:15	–	attackerkb
Circl	CVE-2023-39662	15 Aug 202320:30	–	circl
CNNVD	LlamaIndex Injection Vulnerability	15 Aug 202300:00	–	cnnvd
CVE	CVE-2023-39662	15 Aug 202300:00	–	cve
Cvelist	CVE-2023-39662	15 Aug 202300:00	–	cvelist
EUVD	EUVD-2023-0125	3 Oct 202520:07	–	euvd
Github Security Blog	llama-index vulnerable to arbitrary code execution	15 Aug 202318:31	–	github
NVD	CVE-2023-39662	15 Aug 202317:15	–	nvd
OSV	GHSA-2XXC-73FV-36F7 llama-index vulnerable to arbitrary code execution	15 Aug 202318:31	–	osv
OSV	PYSEC-2023-148	15 Aug 202317:15	–	osv

Source	Link
github	www.github.com/run-llama/llama_index/commit/aa6726706476e0f957a8d57a5ca89e519e93bad7
osv	www.osv.dev/vulnerability/GHSA-2xxc-73fv-36f7
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-39662
twitter	www.twitter.com/CVEnew/status/1691493242422931468
github	www.github.com/run-llama/llama_index/commit/9f3e50a803f519af9ab62e63d413441c43001d81
osv	www.osv.dev/vulnerability/PYSEC-2023-148
twitter	www.twitter.com/AyushRijith/status/2024512795321201122
github	www.github.com/pypa/advisory-database/tree/main/vulns/llama-index/PYSEC-2023-148.yaml
t	www.t.me/cibsecurity/68548
github	www.github.com/jerryjliu/llama_index/issues/7054

19 Feb 2026 00:00Current

6Medium risk

Vulners AI Score6

CVSS 3.19.8

EPSS0.03852

SSVC

llama index remote code execution exec parameter pandas query engine vulnerable version 0.7.13 disable parameter restrict access