CVE-2023-39662

CRITICAL9.8EPSS 3.9%

llama-index vulnerable to arbitrary code execution

Published: 8/15/2023Modified: 9/30/2024

Also known as:GHSA-2xxc-73fv-36f7PYSEC-2023-148

Description

An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function.

Affected packages (2)

PyPI/llama-indexfrom 0, < 0.9.14
PyPI/llama-indexfrom 0, < 0.7.14

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
osv	CVSS 3.1	CRITICAL9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-39662
PATCHhttps://github.com/jerryjliu/llama_index
WEBhttps://github.com/jerryjliu/llama_index/issues/7054
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/llama-index/PYSEC-2023-148.yaml
WEBhttps://github.com/run-llama/llama_index/commit/9f3e50a803f519af9ab62e63d413441c43001d81
WEBhttps://github.com/run-llama/llama_index/commit/aa6726706476e0f957a8d57a5ca89e519e93bad7