{"data":{"id":"e9f22dc3-e0f4-442e-b72b-45cfb10fde8e","title":"CVE-2024-23730: The OpenAPI and ChatGPT plugin loaders in LlamaHub (aka llama-hub) before 0.0.67 allow attackers to execute arbitrary…","summary":"CVE-2024-23730 affects the OpenAPI and ChatGPT plugin loaders in LlamaHub (aka llama-hub) before 0.0.67. Because safe_load is not used for YAML, attackers can execute arbitrary code. NVD has not yet provided an assessment, and the weakness is listed as NVD-CWE-noinfo.","solution":"Fixed in 0.0.67. The source references the v0.0.67 CHANGELOG, a pull request commit (pull/841), and the v0.0.67 release tag as patch and release notes.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-23730","publishedAt":"2024-01-21T22:15:44.373Z","cveId":"CVE-2024-23730","cweIds":null,"cvssScore":"9.8","cvssSeverity":"critical","severity":"critical","attackType":["other"],"issueType":"vulnerability","affectedPackages":["llama-hub@< 0.0.67 (fixed: 0.0.67)"],"affectedPackageNames":["llama-hub"],"affectedPackageRefs":["pypi:llama-hub"],"affectedVendors":["LangChain"],"affectedVendorsRaw":["LlamaHub","llama-hub","LlamaIndex","ChatGPT plugin loaders"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"LlamaHub OpenAPI and ChatGPT plugin loaders allow code execution via YAML","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.01202,"epssCheckedAt":"2026-11-04T18:09:14.876Z","kevDateAdded":null,"advisoryAliases":["GHSA-297x-2qf3-jrj3"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:56:31.804Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2024-01-07T16:57:43.210Z","daysToFix":-14,"fixCheckedAt":"2026-10-29T21:46:27.718Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"llama-hub","fixedVersion":"0.0.67","matchedVersion":"0.0.67","fixReleasedAt":"2024-01-07T16:57:43.210Z","daysToFix":-14,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:46:27.568Z"}]}}