Read the docs
TI-2024-03889 Aliases CVE-2024-4181GHSA-pw38-xv9x-h8ch

Command Injection in run-llama/llama_index

Priority MEDIUM 44CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

A command injection vulnerability exists in the RunGptLLM class of the llama_index library, version 0.9.47, used by the RunGpt framework from JinaAI to connect to Language Learning Models (LLMs). The vulnerability arises from the improper use of the eval function, allowing a malicious or compromised LLM hosting provider to execute arbitrary commands on the client's machine. This issue was fixed in version 0.10.13. The exploitation of this vulnerability could lead to a hosting provider gaining full control over client machines.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02135 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed run-llama/llama_index (run-llama): 0.10.13llama-index (PyPI): 0.10.13+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
run-llamarun-llama/llama_indexbefore 0.10.130.10.13Patch availableCNA
—llama-index (PyPI)before 0.10.130.10.13Patch availableGHSA-pw38-xv9x-h8ch
—llama-index-llms-rungpt (PyPI)before 0.1.30.1.3Patch availableGHSA-pw38-xv9x-h8ch
  • run-llama/llama_index Vendorrun-llama Affected before 0.10.13 Fixed in 0.10.13 Patch available CNA
  • llama-index (PyPI) Vendor— Affected before 0.10.13 Fixed in 0.10.13 Patch available GHSA-pw38-xv9x-h8ch
  • llama-index-llms-rungpt (PyPI) Vendor— Affected before 0.1.3 Fixed in 0.1.3 Patch available GHSA-pw38-xv9x-h8ch

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:llamaindex:llamaindex:*:*:*:*:*:*:*:*0.9.47 to before 0.10.13Vulnerablerun-llama
  • cpe:2.3:a:llamaindex:llamaindex:*:*:*:*:*:*:*:* Versions 0.9.47 to before 0.10.13 Vulnerable ·run-llama

Remediation

  • Fix · CNA run-llama/llama_index (run-llama) Fixed in 0.10.13
  • Fix · GHSA-pw38-xv9x-h8ch llama-index (PyPI) Fixed in 0.10.13 Advisory →
  • Fix · GHSA-pw38-xv9x-h8ch llama-index-llms-rungpt (PyPI) Fixed in 0.1.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-4181
  2. 2026-10-03 Alias added: GHSA-pw38-xv9x-h8ch

References

Exploit 1

Patch 1

Advisory 1

Other 1

  • TI-2025-01545 SQL Injection in run-llama/llama_index CVSS 3.0CRITICAL 9.8
  • TI-2025-01507 SQL Injection in run-llama/llama_index CVSS 3.0CRITICAL 9.8
  • TI-2024-11960 SQL Injection to RCE in run-llama/llama_index CVSS 3.1CRITICAL 9.8
  • TI-2024-11094 SQL Injection in run-llama/llama_index CVSS 3.0CRITICAL 9.8
  • TI-2024-03068 Command Injection in run-llama/llama_index CVSS 3.0CRITICAL 9.8
  • TI-2024-15754 LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL… CVSS 3.1CRITICAL 9.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences