{"data":{"id":"31763d8b-5c80-443e-83af-595327947ec3","title":"CVE-2024-4181: A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the…","summary":"CVE-2024-4181 is a command injection flaw in the RunGptLLM class of the llama_index library, version 0.9.47, which the RunGpt framework from JinaAI uses to connect to LLMs. The class improperly uses the eval function, so a malicious or compromised LLM hosting provider can execute arbitrary commands on the client's machine and gain full control over it.","solution":"Fixed in version 0.10.13.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-4181","publishedAt":"2024-05-16T09:15:15.553Z","cveId":"CVE-2024-4181","cweIds":["CWE-94"],"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["llama-index@< 0.10.13 (fixed: 0.10.13)","llama-index-llms-rungpt@< 0.1.3 (fixed: 0.1.3)"],"affectedPackageNames":["llama-index","llama-index-llms-rungpt"],"affectedPackageRefs":["pypi:llama-index","pypi:llama-index-llms-rungpt"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["llama_index","RunGpt","JinaAI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"llama_index RunGptLLM command injection via eval in LLM provider responses","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.02135,"epssCheckedAt":"2026-11-04T06:10:13.536Z","kevDateAdded":null,"advisoryAliases":["GHSA-pw38-xv9x-h8ch"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:03.717Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-02-24T05:32:56.264Z","daysToFix":-82,"fixCheckedAt":"2026-10-29T21:46:00.369Z","capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"llama-index","fixedVersion":"0.10.13","matchedVersion":"0.10.13","fixReleasedAt":"2024-02-26T20:34:36.940Z","daysToFix":-80,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:00.219Z"},{"ecosystem":"pypi","name":"llama-index-llms-rungpt","fixedVersion":"0.1.3","matchedVersion":"0.1.3","fixReleasedAt":"2024-02-24T05:32:56.264Z","daysToFix":-82,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:46:00.219Z"}]}}