CVE-2024-34359 llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata
Attackers can execute arbitrary code by providing a malicious GGUF model file with a crafted Jinja2 chat template in its metadata.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-34359?
CVE-2024-34359 is a critical code injection vulnerability in abetlen llama-cpp-python, published on 10 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
llama-cpp-python is the Python bindings for llama.cpp. `llama-cpp-python` depends on class `Llama` in `llama.py` to load `.gguf` llama.cpp or Latency Machine Learning Models. The `__init__` constructor built in the `Llama` takes several parameters to configure the loading and running of the model. Other than `NUMA, LoRa settings`, `loading tokenizers,` and `hardware settings`, `__init__` also loads the `chat template` from targeted `.gguf` 's Metadata and furtherly parses it to `llama_chat_format.Jinja2ChatFormatter.to_chat_handler()` to construct the `self.chat_handler` for this model. Nevertheless, `Jinja2ChatFormatter` parse the `chat template` within the Metadate with sandbox-less `jinja2.Environment`, which is furthermore rendered in `__call__` to construct the `prompt` of interaction. This allows `jinja2` Server Side Template Injection which leads to remote code execution by a carefully constructed payload.
Weakness: CWE-76
Which versions are affected by CVE-2024-34359?
3 open source packages ship an affected version, including llama-cpp-python.
| Package | Affected | Fixed in |
|---|---|---|
llama-cpp-python PyPI | From 0.2.30 | 0.2.72 |
llama-cpp-python PyPI | From 0.2.30 | 0.2.72 |
llama-cpp-python PyPI | From 0.2.30 | 0.2.72 |
How do I fix CVE-2024-34359?
Upgrade llama-cpp-python to 0.2.72 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-34359 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-34359 exists.
Sources
Also known as GHSA-56xg-wfcc-g829, PYSEC-2026-392.