{"data":{"id":"56b68565-ec51-4e1d-8297-485a27f31d3b","title":"CVE-2024-3098: A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the…","summary":"A flaw in the `safe_eval` function of the `exec_utils` class in the `llama_index` package allows prompt injection to lead to arbitrary code execution. Insufficient input validation lets an attacker bypass method restrictions and run unauthorized code. It bypasses the previously addressed CVE-2023-39662, and a proof of concept creates a file on the system.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-3098","publishedAt":"2024-04-10T17:15:56.213Z","cveId":"CVE-2024-3098","cweIds":["CWE-94"],"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":["llama-index-core@< 0.10.24 (fixed: 0.10.24)"],"affectedPackageNames":["llama-index-core"],"affectedPackageRefs":["pypi:llama-index-core"],"affectedVendors":["LlamaIndex"],"affectedVendorsRaw":["llama_index"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"llama_index code execution via prompt injection in safe_eval","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00959,"epssCheckedAt":"2026-11-04T06:10:14.970Z","kevDateAdded":null,"advisoryAliases":["GHSA-wvpx-g427-q9wc"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:19.127Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-03-26T22:03:42.056Z","daysToFix":-15,"fixCheckedAt":"2026-10-29T21:46:15.519Z","capecIds":["CAPEC-242"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity","safety"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"pypi","name":"llama-index-core","fixedVersion":"0.10.24","matchedVersion":"0.10.24","fixReleasedAt":"2024-03-26T22:03:42.056Z","daysToFix":-15,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:46:15.367Z"}]}}