GHSA-2xxc-73fv-36f7

llama-index vulnerable to arbitrary code execution

Source: GitHub Advisory Database (reviewed) Critical CVE-2023-39662

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	llama-index	< 0.9.14	0.9.14

Details

As written in the advisory (Markdown source, shown as plain text).

An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-39662 advisory
https://github.com/jerryjliu/llama_index/issues/7054 web
https://github.com/run-llama/llama_index/commit/9f3e50a803f519af9ab62e63d413441c43001d81 web
https://github.com/run-llama/llama_index/commit/aa6726706476e0f957a8d57a5ca89e519e93bad7 web
https://github.com/jerryjliu/llama_index package
https://github.com/pypa/advisory-database/tree/main/vulns/llama-index/PYSEC-2023-148.yaml web