7 matches found
langtrace-python-sdk (>=1.0.9, <=1.1.30), lavague (>=1.0.3.post1, <=1.0.15) +376 more potentially affected by CVE-2024-3271 via llama-index-core (>=0.9.56, <=0.10.19)
llama-index-core PYPI version =0.9.56, =1.0.9, =1.0.3.post1, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =0.0.1, =0.1.0 and more Source cves: CVE-2024-3271 Source advisory: OSV:PYSEC-2026-396...
langtrace-python-sdk (>=1.0.9, <=1.1.30), lavague (>=1.0.3.post1, <=1.0.15) +376 more potentially affected by CVE-2024-3271 via llama-index-core (>=0.9.56, <=0.10.19)
llama-index-core PYPI version =0.9.56, =1.0.9, =1.0.3.post1, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =0.0.1, =0.1.0 and more Source cves: CVE-2024-3271 Source advisory: OSV:GHSA-R6GP-RFF2-P3HF...
CVE-2024-3271
A command injection vulnerability exists in the run-llama/llamaindex repository, specifically within the safeeval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. This is achieved by...
CVE-2024-3271
CVE-2024-3271 affects the run-llama/llama_index project, specifically the safe_eval function. The issue allows command execution via crafted input that bypasses the underscore check in code produced by LLMs, enabling remote code execution on the server. Connected sources corroborate a command-inj...
CVE-2024-3271 Command Injection in run-llama/llama_index
A command injection vulnerability exists in the run-llama/llamaindex repository, specifically within the safeeval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. This is achieved by...
langtrace-python-sdk (>=1.0.9, <=1.1.30), lavague (>=1.0.3.post1, <=1.0.15) +376 more potentially affected by CVE-2024-3271 via llama-index-core (>=0.9.56, <=0.10.19)
llama-index-core PYPI version =0.9.56, =1.0.9, =1.0.3.post1, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.2, =0.0.1, =0.1.0 and more Source cves: CVE-2024-3271 Source advisory: MEND:CVE-2024-3271...
CVE-2024-3271 Command Injection in run-llama/llama_index
A command injection vulnerability exists in the run-llama/llamaindex repository, specifically within the safeeval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. This is achieved by...