82 matches found
llama-index-core Command Injection vulnerability
A command injection vulnerability exists in the run-llama/llamaindex repository, specifically within the safeeval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. This is achieved by...
PT-2026-53481
A command injection vulnerability exists in the run-llama/llama index repository, specifically within the safe eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. This is achieved by...
EUVD-2026-38569
Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the safeevalexpression function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes giframe, fback, fbuiltins do NOT...
Improper Control of Dynamically-Managed Code Resources
Overview Crawl4AI is a ๐๐ค Crawl4AI: Open-source LLM Friendly Web Crawler & scraper Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources via the safeevalexpression function. An attacker can execute arbitrary system commands, read or write files...
EUVD-2018-0337
Malware in sbrugna...
EUVD-2020-0626
Malware in sbrugna...
EUVD-2023-1322
Malicious code in bioql PyPI...
EUVD-2022-7480
Malicious code in bioql PyPI...
CVE-2023-26122
All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation. Exploiting this vulnerability might result in remote code execution "RCE". Vulnerable functions: defineGetter, stack,...
CVE-2023-26121
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content...
CVE-2024-3271 Command Injection in run-llama/llama_index
A command injection vulnerability exists in the run-llama/llamaindex repository, specifically within the safeeval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. This is achieved by...
llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
A vulnerability was identified in the executils class of the llamaindex package, specifically within the safeeval function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method...
LlamaIndex ไปฃ็ ๆณจๅ ฅๆผๆด
LlamaIndex is a data framework for an LLM application by the individual developer Jerry Liu. A code injection vulnerability exists in LlamaIndex that stems from insufficient input validation of the safeeval function in executils, which allows injection at the prompt, leading to arbitrary code...
Remote Code Execution (RCE)
safe-eval is vulnerable to Sandbox Bypass. The vulnerability exists due to improper input sanitization which allows an attacker to execute arbitrary codes into the system...
@550w-tools/cli (>=0.0.14, <=0.0.16), @550w-tools/core (>=0.0.14, <=0.0.16) +541 more potentially affected by CVE-2023-26122 via safe-eval (>=0.2.0, <=0.4.1)
safe-eval NPM version =0.2.0, =0.0.14, =0.0.14, =0.0.13, =0.0.14, =0.0.15, =1.0.1, =1.0.2, =1.0.3, =1.1.2, =0.1.16-beta.1, =1.0.0-beta.4, =0.3.0-alpha.1, =0.20.0, =2.0.295, =2.0.315 and more Source cves: CVE-2023-26122 Source advisory: OSV:GHSA-79XF-67R4-Q2JJ...
safe-eval vulnerable to Prototype Pollution via the safeEval function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content...
GHSA-HCG3-56JF-X4VH safe-eval vulnerable to Prototype Pollution via the safeEval function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content...
GHSA-79XF-67R4-Q2JJ safe-eval vulnerable to Sandbox Bypass due to improper input sanitization
All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation. Exploiting this vulnerability might result in remote code execution RCE. Vulnerable functions: defineGetter, stack,...
@550w-tools/cli (>=0.0.14, <=0.0.16), @550w-tools/core (>=0.0.14, <=0.0.16) +541 more potentially affected by CVE-2023-26121 via safe-eval (>=0.2.0, <=0.4.1)
safe-eval NPM version =0.2.0, =0.0.14, =0.0.14, =0.0.13, =0.0.14, =0.0.15, =1.0.1, =1.0.2, =1.0.3, =1.1.2, =0.1.16-beta.1, =1.0.0-beta.4, =0.3.0-alpha.1, =0.20.0, =2.0.295, =2.0.315 and more Source cves: CVE-2023-26121 Source advisory: OSV:GHSA-HCG3-56JF-X4VH...
CVE-2023-26122
All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation. Exploiting this vulnerability might result in remote code execution "RCE". Vulnerable functions: defineGetter, stack,...