CVE-2024-4181

Name of the Vulnerable Software and Affected Versions llama index library version 0.9.47

Description A command injection issue exists due to the improper use of the eval function in the RunGptLLM class, allowing a malicious LLM hosting provider to execute arbitrary commands on the client's machine. This could lead to a hosting provider gaining full control over client machines.

Recommendations For version 0.9.47, update to version 0.10.13 to resolve the issue. As a temporary workaround, consider restricting access to the eval function in the RunGptLLM class until the update is applied.