CVE-2023-39662

An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the exec parameter in PandasQueryEngine function.

Published: Aug 15, 2023
Updated: May 9, 2024
CVE: CVE-2023-39662
GHSA: GHSA-2xxc-73fv-36f7
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWEs:

CWE-74
CWE-94

Affected Software
References

Software	From	Fixed in
llamaindex_project / llamaindex	-	0.7.13.x
llama-index	-	0.9.14

https://github.com/jerryjliu/llama_index/issues/7054
https://github.com/run-llama/llama_index/commit/9f3e50a803f519af9ab62e63d413441c43001d81
https://github.com/run-llama/llama_index/commit/aa6726706476e0f957a8d57a5ca89e519e93bad7

Vulnerability Database

CVE-2023-39662