{"id":"CVE-2024-23730","kind":"vulnerability","aliases":["CVE-2024-23730","GHSA-297x-2qf3-jrj3"],"related":[],"title":"Unsafe yaml deserialization in llama-hub","description":"The OpenAPI and ChatGPT plugin loaders in LlamaHub (aka llama-hub) before 0.0.67 allow attackers to execute arbitrary code because safe_load is not used for YAML.","summary":"LlamaHub's OpenAPI and ChatGPT plugin loaders parse YAML with an unsafe loader instead of safe_load. A crafted YAML document loaded by these plugins can make the process execute arbitrary code.","severity":"critical","cvss":9.8,"epss":0.01202,"exploited":false,"exploited_at":null,"products":[{"name":"llama-hub","fixed":["0.0.67"],"affected":"< 0.0.67","ecosystem":"pypi"},{"name":"llamahub","fixed":["0.0.67"],"affected":"< 0.0.67","ecosystem":"vendor"}],"ecosystems":["pypi","vendor"],"tags":["ai-apps","ai-tooling","cwe-502","llama-hub","llamaindex","python"],"not_affected_if":["not-using-plugin-loaders","trusted-input-only","version-0.0.67-or-later"],"how_to_check":"- Run `pip show llama-hub` and check whether the version is below `0.0.67`\n- Search the codebase for `llama_hub` imports of the OpenAPI or ChatGPT plugin loaders\n- Check whether the loaders are fed YAML from users or other untrusted sources","fix":"- Upgrade `llama-hub` to `0.0.67` or later\n- Until upgraded, do not load OpenAPI or ChatGPT plugin specs from untrusted sources","status":"open","published_at":"2024-01-21T17:15:44+00:00","first_seen_at":"2026-10-27T17:32:35+00:00","triaged_at":"2026-10-27T17:36:17+00:00","updated_at":"2026-10-27T17:36:17+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-27T17:36:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `llama-hub` to `0.0.67` or later\n- Until upgraded, do not load OpenAPI or ChatGPT plugin specs from untrusted sources","reach":"unknown","title":"llama-hub: unsafe YAML loading lets a crafted spec run code","impact":"high","summary":"LlamaHub's OpenAPI and ChatGPT plugin loaders parse YAML with an unsafe loader instead of safe_load. A crafted YAML document loaded by these plugins can make the process execute arbitrary code.","category":"ai-tooling","nicknames":[],"who_cares":["python","llama-hub","llamaindex","ai-apps"],"confidence":0.8,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the server processing the YAML.","analyst_note":"","how_to_check":"- Run `pip show llama-hub` and check whether the version is below `0.0.67`\n- Search the codebase for `llama_hub` imports of the OpenAPI or ChatGPT plugin loaders\n- Check whether the loaders are fed YAML from users or other untrusted sources","needs_analyst":false,"not_affected_if":["not-using-plugin-loaders","trusted-input-only","version-0.0.67-or-later"],"who_is_affected":"Applications that use the llama-hub Python package before 0.0.67 and load OpenAPI or ChatGPT plugin definitions through its YAML loaders are exposed. The risk is highest where the YAML comes from users or third parties. Teams that do not use these loaders, or that only load trusted local files, are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000638,"input_tokens":3387,"output_tokens":599,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2024':9A,17A '-23730':10A,18A '-502':30B '0.0.67':81C '297x':13A '2qf3':14A 'ai':24B,27B 'ai-app':23B 'ai-tool':26B 'aka':76C 'allow':82C 'app':25B 'arbitrari':66B,86C 'attack':83C 'chatgpt':40B,71C 'code':67B,87C 'craft':54B 'cve':8A,16A 'cwe':29B 'deseri':3A 'document':56B 'execut':65B,85C 'ghsa':12A 'ghsa-297x-2qf3-jrj3':11A 'hub':7A,21A,33B,79C 'instead':49B 'jrj3':15A 'llama':6A,20A,32B,78C 'llama-hub':5A,19A,31B,77C 'llamahub':22A,36B,75C 'llamaindex':34B 'load':52B,57B,90C 'loader':42B,48B,73C 'make':62B 'openapi':38B,69C 'pars':43B 'plugin':41B,60B,72C 'process':64B 'python':35B 'safe':51B,89C 'tool':28B 'unsaf':1A,47B 'use':93C 'yaml':2A,44B,55B,95C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the llama-hub Python package before 0.0.67 and load OpenAPI or ChatGPT plugin definitions through its YAML loaders are exposed. The risk is highest where the YAML comes from users or third parties. Teams that do not use these loaders, or that only load trusted local files, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2024-01-21T17:15:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-297x-2qf3-jrj3","url":"https://github.com/advisories/GHSA-297x-2qf3-jrj3","severity":"critical","published_at":"2024-01-21T18:30:34+00:00","modified_at":"2026-10-27T17:29:40+00:00","first_seen_at":"2026-10-27T17:32:35+00:00","fetched_at":"2026-10-27T17:32:35+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-23730","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23730","severity":null,"published_at":"2024-01-21T17:15:44+00:00","modified_at":"2026-06-17T07:13:28+00:00","first_seen_at":"2026-10-27T17:32:47+00:00","fetched_at":"2026-10-27T17:32:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}