CVE-2024-4181— LlamaIndex 代码注入漏洞

Command Injection in run-llama/llama_index

A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect to Language Learning Models (LLMs). The vulnerability arises from the improper use of the eval function, allowing a malicious or compromised LLM hosting provider to execute arbitrary commands on the client's machine. This issue was fixed in version 0.10.13. The exploitation of this vulnerability could lead to a hosting provider gaining full control over client machines.

N/A

对生成代码的控制不恰当(代码注入)

LlamaIndex 代码注入漏洞

LlamaIndex是Jerry Liu个人开发者的一个 LLM 应用程序的数据框架。 LlamaIndex 0.9.47版本存在代码注入漏洞，该漏洞源于 eval 函数的不当使用，允许恶意或受损的 LLM 托管提供商在客户端计算机上执行任意命令。

N/A

N/A