Command Injection in run-llama/llama_index

published 2024-05-16 2 y ago modified 2026-07-13 3 mo ago also GHSA-pw38-xv9x-h8ch , PYSEC-2024-324 , PYSEC-2026-1565 , EUVD-2024-1728

cvss: 8.8; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 2.1%; EPSS 2.1% chance of exploitation in 30 days, percentile 82%
public exploits: 0; none known

A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect to Language Learning Models (LLMs). The vulnerability arises from the improper use of the eval function, allowing a malicious or compromised LLM hosting provider to execute arbitrary commands on the client's machine. This issue was fixed in version 0.10.13. The exploitation of this vulnerability could lead to a hosting provider gaining full control over client machines.

Patch / fix

fixed in 3 links 1

pypi llama-index 0.10.13
pypi llama-index-llms-rungpt 0.1.3
run-llama run-llama/llama_index 0.10.13

github.com/run-llama/llama_index@d73715e commit

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-05-16)

Exploit prediction

2.14% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

huntr.com https://huntr.com/bounties/1a204520-598a-434e-b13d-0d34f2a5ddc1 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
OSV	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
GitHub	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	llama-index	<0.10.13 >=0.9.47, <0.10.13	0.10.13
pypi	llama-index-llms-rungpt	<0.1.3	0.1.3

Affected products

run-llama run-llama/llama_index
run-llama llama_index

Classification

Weakness

CWE-94 Improper Control of Generation of Code

References

github.com /run-llama/llama_index/commit/d73715eaf0642705583e7897c78b9c8dd2d3a7ba
web, patch
huntr.com /bounties/1a204520-598a-434e-b13d-0d34f2a5ddc1
web, exploit, third-party-advisory, evidence
nvd.nist.gov /vuln/detail/CVE-2024-4181
advisory
github.com /run-llama/llama_index
package
pypi.org /project/llama-index-llms-rungpt
package
github.com /advisories/GHSA-pw38-xv9x-h8ch
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary