CVE-2024-3271 json
Command Injection in run-llama/llama_index
published 2024-04-16 2 y ago modified 2026-07-01 4 mo ago also GHSA-r6gp-rff2-p3hf , PYSEC-2026-396 , EUVD-2024-1292
- cvss
- 9.8
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.9%
- EPSS 2.9% chance of exploitation in 30 days, percentile 86%
- public exploits
- 0
- none known
Summary
A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. This is achieved by crafting input that does not contain an underscore but still results in the execution of OS commands. The vulnerability allows for remote code execution (RCE) on the server hosting the application.
Patch / fix
- pypi llama-index-core 0.10.24
- run-llama run-llama/llama_index 10.26
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
2.89% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/9b32490e-7cf9-470e-8d49-ba083ae7a279 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | llama-index-core | <0.10.24 |
0.10.24 |
Affected products
- run-llama run-llama/llama_index
- run-llama llama_index
Classification
- Weakness
-
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
-
github.com
/run-llama/llama_index/commit/5fbcb5a8b9f20f81b791c7fc8849e352613ab475
web, patch
-
github.com
/run-llama/llama_index/commit/2c92e88838a5f481d50840240b1dd3180066c6f5
web
-
huntr.com
/bounties/9b32490e-7cf9-470e-8d49-ba083ae7a279
web, exploit, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-3271
advisory
-
github.com
/run-llama/llama_index
package
-
pypi.org
/project/llama-index-core
package
-
github.com
/advisories/GHSA-r6gp-rff2-p3hf
advisory
Sources
- CVE List CVE-2024-3271
- GitHub Advisory GHSA-r6gp-rff2-p3hf
- NVD CVE-2024-3271
- OSV PYSEC-2026-396
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.