Home > Vulnerability Database > CVE-2024-45201

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2024-45201

Good to know:

Date: August 21, 2024

An issue was discovered in llama_index before 0.10.38. download/integration.py includes an exec call for import {cls_name}.

Language: Python

Severity Score

8.8

Related Resources (7)

Url: https://github.com/run-llama/llama_index/compare/v0.10.37...v0.10.38

Url: https://github.com/run-llama/llama_index

Url: https://github.com/run-llama/llama_index/pull/13523

Url: https://github.com/pypa/advisory-database/tree/main/vulns/llama-index/PYSEC-2024-192.yaml

Url: https://github.com/run-llama/llama_index/commit/bd827c30484fa085ec769fa55dc7f2add8006ac8

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-45201

Url: https://www.mend.io/vulnerability-database/CVE-2024-45201

Severity Score

8.8

Weakness Type (CWE)

Improper Control of Generation of Code ('Code Injection')

CWE-94

Top Fix

Upgrade Version

Upgrade to version llama-index-core - 0.10.38;llama-index - 0.10.38

CVSS v3.1

Base Score:	8.8
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	LOW
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	HIGH

Do you need more information?

Contact Us