Description
A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect to Language Learning Models (LLMs). The vulnerability arises from the improper use of the eval function, allowing a malicious or compromised LLM hosting provider to execute arbitrary commands on the client's machine. This issue was fixed in version 0.10.13. The exploitation of this vulnerability could lead to a hosting provider gaining full control over client machines.
INFO
Published Date :
2024-05-16T09:03:47.278Z
Last Modified :
2024-08-01T20:33:52.659Z
Source :
@huntr_ai
AFFECTED PRODUCTS
The following products are affected by CVE-2024-4181 vulnerability.
| Vendors | Products |
|---|---|
| Llamaindex |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2024-4181.
