CVE-2024-3098 json
Prompt Injection leading to Arbitrary Code Execution in run-llama/llama_index
published 2024-04-10 2 y ago modified 2026-10-27 12 d ago also GHSA-wvpx-g427-q9wc , PYSEC-2026-397 , EUVD-2024-1326
- cvss
- 9.8
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 61%
- public exploits
- 0
- none known
Summary
A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code. The vulnerability is a bypass of the previously addressed CVE-2023-39662, demonstrated through a proof of concept that creates a file on the system by exploiting the flaw.
Patch / fix
- pypi llama-index-core 0.10.24
- run-llama run-llama/llama_index 0.10.24
- run-llama llama_index 0.10.24
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.96% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | llama-index-core | <0.10.24 |
0.10.24 |
Affected products
- run-llama run-llama/llama_index
- run-llama llama_index
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
github.com
/run-llama/llama_index/commit/5fbcb5a8b9f20f81b791c7fc8849e352613ab475
web
-
github.com
/run-llama/llama_index/commit/2c92e88838a5f481d50840240b1dd3180066c6f5
web
-
huntr.com
/bounties/1bce0d61-ad03-4b22-bc32-8f99f92974e7
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-3098
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/llama-index-core/PYSEC-2026-397.yaml
web
-
github.com
/run-llama/llama_index
package
-
pypi.org
/project/llama-index-core
web, package
-
github.com
/advisories/GHSA-wvpx-g427-q9wc
advisory
Sources
- CVE List CVE-2024-3098
- GitHub Advisory GHSA-wvpx-g427-q9wc
- NVD CVE-2024-3098
- OSV PYSEC-2026-397
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.