Arbitrary Code Execution Vulnerability in llama_index's exec_utils

CVE-2024-3098

What is CVE-2024-3098?

A vulnerability exists in the exec_utils class of the llama_index package, particularly within the safe_eval function. This flaw allows for prompt injection, enabling attackers to execute arbitrary code on affected systems. The root cause lies in inadequate validation of user input, which can be exploited to circumvent access controls and run unauthorized commands. This vulnerability is an advancement of a previously addressed issue, providing a means to create files on the system through proof-of-concept exploits.

References