CriticalVulnerabilityLLM-specific
CVE-2024-4181: llama_index RunGptLLM command injection via eval in LLM provider responses
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2024-4181
- Published
- Record updated
- Affected
- llama-index < 0.10.13, fixed in 0.10.13, released February 26, 2024, 80 days before disclosure
- llama-index-llms-rungpt < 0.1.3, fixed in 0.1.3, released February 24, 2024, 82 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 2.1%
Summary
CVE-2024-4181 is a command injection flaw in the RunGptLLM class of the llama_index library, version 0.9.47, which the RunGpt framework from JinaAI uses to connect to LLMs. The class improperly uses the eval function, so a malicious or compromised LLM hosting provider can execute arbitrary commands on the client's machine and gain full control over it.
Mitigation
Fixed in version 0.10.13.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- llama-indexPyPILLM dependency since 2023-02-16 · 12 tracked dependents
Related items
- MediumGHSA-8prr-f582-jqq3: LangGraph CLI prints the registry push token in `langgraph deploy --verbose` outputSame vendor · GitHub Advisory Database
- HighGHSA-4hm6-w6qq-w73v: LangGraph JavaScript custom authentication may permit cross-user Store accessSame vendor · GitHub Advisory Database
- MediumGHSA-3fx2-cqw9-xr3c: LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requestsSame vendor · GitHub Advisory Database
- MediumGHSA-6hmw-9432-67qq: LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite storesSame vendor · GitHub Advisory Database
- MediumCVE-2026-108575: BerriAI LiteLLM improper authorization in secret resolution via api_keySame vendor · NVD/CVE Database