CVE-2024-3098 Prompt Injection leading to Arbitrary Code Execution in run-llama/llama_index
Attackers can execute arbitrary code via prompt injection in the safe_eval function of the llama_index library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-3098?
CVE-2024-3098 is a critical code injection vulnerability in run-llama/llama_index, published on 10 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code. The vulnerability is a bypass of the previously addressed CVE-2023-39662, demonstrated through a proof of concept that creates a file on the system by exploiting the flaw.
Weakness: CWE-94
Which versions are affected by CVE-2024-3098?
3 open source packages ship an affected version, including llama-index-core.
| Package | Affected | Fixed in |
|---|---|---|
llama-index-core PyPI | All versions | 0.10.24 |
llama-index-core PyPI | All versions | 0.10.24 |
llama-index-core PyPI | All versions | 0.10.24 |
How do I fix CVE-2024-3098?
Upgrade llama-index-core to 0.10.24 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-3098 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-3098 exists.
Sources
Also known as GHSA-wvpx-g427-q9wc, PYSEC-2026-397.