All vulnerabilities
CVE-2024-3098GHSA-wvpx-g427-q9wcPYSEC-2026-397

llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution

run-llama llama-index-corepipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 25 Jul 2024. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.96%Chance of exploitation activity in the next 30 days, higher than 61% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed in0.10.24Fixed versionGitHub
Published10 Apr 2024Updated 27 Oct 2026CVE List

What fixes it

  • 0.10.24llama-index-core, pipGitHub
  • 0.10.24run-llama/llama_indexCVE List
  • 0.10.24llama-index-core, PyPIOSVpip install "llama-index-core>=0.10.24"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A vulnerability was identified in the exec_utils class of the llama_index package, specifically within the safe_eval function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code. The vulnerability is a bypass of the previously addressed CVE-2023-39662, demonstrated through a proof of concept that creates a file on the system by exploiting the flaw.

Text from CVE List

Affected versions 53

  • llama-index-core, pip< 0.10.24GitHub
  • run-llama/llama_indexaffected: unspecified before 0.10.24CVE List
  • llama-index-core, PyPIfrom first release, fixed in 0.10.24OSV
  • llama-index-core, PyPI0.10.0OSV
  • llama-index-core, PyPI0.10.1OSV
  • llama-index-core, PyPI0.10.10OSV
  • llama-index-core, PyPI0.10.11OSV
  • llama-index-core, PyPI0.10.11.post1OSV
  • llama-index-core, PyPI0.10.12OSV
  • llama-index-core, PyPI0.10.13OSV
  • llama-index-core, PyPI0.10.14OSV
  • llama-index-core, PyPI0.10.14.post1OSV
  • llama-index-core, PyPI0.10.15OSV
  • llama-index-core, PyPI0.10.16OSV
  • llama-index-core, PyPI0.10.16.post1OSV
  • llama-index-core, PyPI0.10.17OSV
  • llama-index-core, PyPI0.10.18OSV
  • llama-index-core, PyPI0.10.18.post1OSV
  • llama-index-core, PyPI0.10.19OSV
  • llama-index-core, PyPI0.10.2OSV
  • llama-index-core, PyPI0.10.20OSV
  • llama-index-core, PyPI0.10.20.post1OSV
  • llama-index-core, PyPI0.10.20.post2OSV
  • llama-index-core, PyPI0.10.20.post3OSV
  • llama-index-core, PyPI0.10.21OSV
  • llama-index-core, PyPI0.10.21.post1OSV
  • llama-index-core, PyPI0.10.22OSV
  • llama-index-core, PyPI0.10.23OSV
  • llama-index-core, PyPI0.10.23.post1OSV
  • llama-index-core, PyPI0.10.24a1OSV
  • llama-index-core, PyPI0.10.3OSV
  • llama-index-core, PyPI0.10.5OSV
  • llama-index-core, PyPI0.10.5a1OSV
  • llama-index-core, PyPI0.10.5a10OSV
  • llama-index-core, PyPI0.10.5a2OSV
  • llama-index-core, PyPI0.10.5a3OSV
  • llama-index-core, PyPI0.10.5a4OSV
  • llama-index-core, PyPI0.10.5a5OSV
  • llama-index-core, PyPI0.10.5a6OSV
  • llama-index-core, PyPI0.10.5a7OSV
  • llama-index-core, PyPI0.10.5a8OSV
  • llama-index-core, PyPI0.10.5a9OSV
  • llama-index-core, PyPI0.10.6OSV
  • llama-index-core, PyPI0.10.6.post1OSV
  • llama-index-core, PyPI0.10.7OSV
  • llama-index-core, PyPI0.10.8OSV
  • llama-index-core, PyPI0.10.8.post1OSV
  • llama-index-core, PyPI0.10.9OSV
  • llama-index-core, PyPI0.9.41OSV
  • llama-index-core, PyPI0.9.42OSV
  • llama-index-core, PyPI0.9.42.post3OSV
  • llama-index-core, PyPI0.9.43OSV
  • llama-index-core, PyPI0.9.44OSV

References 7