Prompt Injection leading to Arbitrary Code Execution in run-llama/llama_index
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code. The vulnerability is a bypass of the previously addressed CVE-2023-39662, demonstrated through a proof of concept that creates a file on the system by exploiting the flaw.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| run-llama | run-llama/llama_index | before 0.10.24 | 0.10.24 | Patch available | CNA |
| — | llama-index-core (PyPI) | before 0.10.24 | 0.10.24 | Patch available | GHSA-wvpx-g427-q9wc |
- run-llama/llama_index Vendorrun-llama Affected before 0.10.24 Fixed in 0.10.24 Patch available CNA
- llama-index-core (PyPI) Vendor— Affected before 0.10.24 Fixed in 0.10.24 Patch available GHSA-wvpx-g427-q9wc
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:run-llama:llama_index:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:run-llama:llama_index:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
- Fix · CNA run-llama/llama_index (run-llama) Fixed in 0.10.24
- Fix · GHSA-wvpx-g427-q9wc llama-index-core (PyPI) Fixed in 0.10.24 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-3098
- 2026-10-03 Alias added: GHSA-wvpx-g427-q9wc
References
Other 6
- https://huntr.com/bounties/1bce0d61-ad03-4b22-bc32-8f99f92974e7
- https://github.com/run-llama/llama_index/commit/5fbcb5a8b9f20f81b791c7fc8849e352613ab475
- https://github.com/run-llama/llama_index/commit/2c92e88838a5f481d50840240b1dd3180066c6f5
- https://github.com/pypa/advisory-database/tree/main/vulns/llama-index-core/PYSEC-2026-397.yaml
- https://github.com/run-llama/llama_index
- https://pypi.org/project/llama-index-core
More run-llama vulnerabilities
- TI-2025-01545 SQL Injection in run-llama/llama_index CVSS 3.0CRITICAL 9.8
- TI-2025-01507 SQL Injection in run-llama/llama_index CVSS 3.0CRITICAL 9.8
- TI-2024-11960 SQL Injection to RCE in run-llama/llama_index CVSS 3.1CRITICAL 9.8
- TI-2024-11094 SQL Injection in run-llama/llama_index CVSS 3.0CRITICAL 9.8
- TI-2024-03068 Command Injection in run-llama/llama_index CVSS 3.0CRITICAL 9.8
- TI-2024-15754 LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-3098 · CVE Program
- CVE-2024-3098 · NVD
- FIRST EPSS
- GHSA-wvpx-g427-q9wc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences