llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution

llama-index-core (pip)

A vulnerability was identified in the exec_utils class of the llama_index package, specifically within the safe_eval function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code.

Fix it

pip install --upgrade "llama-index-core>=0.10.24"

First seen: 10 Apr 2024
Last update: 10 Apr 2024, 18:30 UTC
Fixed in: llama-index-core 0.10.24
Identifiers: CVE-2024-3098
Source: GitHub advisory
On the menu as: PyPI packages
LLM gateways

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution
Severity: critical. Patch status: patched.
Affected: llama-index-core (pip)
Fixed in: llama-index-core 0.10.24
Ids: CVE-2024-3098

A vulnerability was identified in the exec_utils class of the llama_index package, specifically within the safe_eval function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code.

## Steps
1. This incident involves a provider (ai-gateways). Search config, CI and env templates (.env.example, wrangler.toml, vercel.json, terraform, workflow secrets) for credentials stored there. List each secret by name, where it is used, and how to rotate it. Never print secret values.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2024-3098") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/advisories/GHSA-wvpx-g427-q9wc https://github.com/run-llama/llama_index/commit/2c92e88838a5f481d50840240b1dd3180066c6f5 https://github.com/run-llama/llama_index/commit/5fbcb5a8b9f20f81b791c7fc8849e352613ab475 https://huntr.com/bounties/1bce0d61-ad03-4b22-bc32-8f99f92974e7 https://nvd.nist.gov/vuln/detail/CVE-2024-3098
https://pwned.coffee/i/llama-index-core-prompt-injection-vulnerability-leading-cve-2024-3098

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone very hot coffee