{"id":"CVE-2024-3098","kind":"vulnerability","aliases":["CVE-2024-3098","GHSA-wvpx-g427-q9wc"],"related":[],"title":"llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution","description":"A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code. The vulnerability is a bypass of the previously addressed CVE-2023-39662, demonstrated through a proof of concept that creates a file on the system by exploiting the flaw.","summary":"llama-index-core's exec_utils safe_eval function fails to block some code, so a prompt that reaches the pipeline can make the library run attacker-chosen code. The sources cite a proof of concept that writes a file on the host, and the flaw bypasses an earlier fix for CVE-2023-39662.","severity":"critical","cvss":9.8,"epss":0.00959,"exploited":false,"exploited_at":null,"products":[{"name":"llama-index-core","fixed":["0.10.24"],"affected":"< 0.10.24","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-apps","ai-tooling","cwe-94","llama-index","python","rag","self-hosted"],"not_affected_if":["no-code-evaluation-path"],"how_to_check":"- Run `pip show llama-index-core` and compare the version with `0.10.24`\n- Search the project lockfiles for `llama-index-core` below `0.10.24`","fix":"- Upgrade `llama-index-core` to `0.10.24` or later\n- Rebuild and redeploy services that bundle the library so the fixed version ships","status":"open","published_at":"2024-04-10T17:15:56+00:00","first_seen_at":"2026-10-27T17:32:35+00:00","triaged_at":"2026-10-27T17:36:17+00:00","updated_at":"2026-10-27T17:36:17+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-27T17:36:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `llama-index-core` to `0.10.24` or later\n- Rebuild and redeploy services that bundle the library so the fixed version ships","reach":"internet","title":"LlamaIndex core: prompt injection reaches code execution through safe_eval bypass","impact":"high","summary":"llama-index-core's exec_utils safe_eval function fails to block some code, so a prompt that reaches the pipeline can make the library run attacker-chosen code. The sources cite a proof of concept that writes a file on the host, and the flaw bypasses an earlier fix for CVE-2023-39662.","category":"ai-tooling","nicknames":[],"who_cares":["python","llama-index","ai-apps","rag","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the server hosting the application","analyst_note":"Confirm which LlamaIndex features route to exec_utils.safe_eval and whether the default configuration reaches it; see GHSA-wvpx-g427-q9wc and NVD CVE-2024-3098.","how_to_check":"- Run `pip show llama-index-core` and compare the version with `0.10.24`\n- Search the project lockfiles for `llama-index-core` below `0.10.24`","needs_analyst":true,"not_affected_if":["no-code-evaluation-path"],"who_is_affected":"Applications that pass model output or user-supplied text into LlamaIndex features that call safe_eval, such as pandas query or similar code-evaluating paths, are exposed. Projects that use LlamaIndex only for retrieval over fixed documents, with no prompt-driven evaluation path, are less exposed, but the sources do not spell out which features reach safe_eval.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000668,"input_tokens":3466,"output_tokens":643,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2023':98B,160C '-2024':14A,22A '-3098':15A,23A '-39662':99B,161C '-94':35B 'address':158C 'ai':29B,32B 'ai-app':28B 'ai-tool':31B 'allow':120C 'app':30B 'arbitrari':10A,126C 'aris':131C 'attack':72B 'attacker-chosen':71B 'block':56B 'bypass':92B,143C,154C 'chosen':73B 'cite':77B 'class':108C 'code':11A,58B,74B,127C,149C 'concept':81B,167C 'core':4A,27A,47B 'creat':169C 'cve':13A,21A,97B,159C 'cwe':34B 'demonstr':162C 'due':132C 'earlier':94B 'eval':52B,118C 'exec':49B,106C 'execut':12A,128C,147C 'exploit':141C,176C 'fail':54B 'file':85B,171C 'fix':95B 'flaw':91B,178C 'function':53B,119C 'g427':19A 'ghsa':17A 'ghsa-wvpx-g427-q9wc':16A 'host':43B,88B 'identifi':103C 'index':3A,26A,38B,46B,112C 'inject':6A,123C 'input':137C 'insuffici':134C 'issu':130C 'lead':8A,124C 'librari':69B 'llama':2A,25A,37B,45B,111C 'llama-index':36B 'llama-index-cor':1A,44B 'llama-index-core':24A 'make':67B 'method':144C 'packag':113C 'pipelin':65B 'previous':157C 'prompt':5A,61B,122C 'proof':79B,165C 'python':39B 'q9wc':20A 'rag':40B 'reach':63B 'restrict':145C 'run':70B 'safe':51B,117C 'self':42B 'self-host':41B 'sourc':76B 'specif':114C 'system':174C 'tool':33B 'unauthor':148C 'util':50B,107C 'valid':135C 'vulner':7A,101C,151C 'within':115C 'write':83B 'wvpx':18A","nicknames":[],"mitigations":[],"who_affected":"Applications that pass model output or user-supplied text into LlamaIndex features that call safe_eval, such as pandas query or similar code-evaluating paths, are exposed. Projects that use LlamaIndex only for retrieval over fixed documents, with no prompt-driven evaluation path, are less exposed, but the sources do not spell out which features reach safe_eval.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2024-04-10T17:15:56+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-wvpx-g427-q9wc","url":"https://github.com/advisories/GHSA-wvpx-g427-q9wc","severity":"critical","published_at":"2024-04-10T18:30:48+00:00","modified_at":"2026-10-27T17:29:57+00:00","first_seen_at":"2026-10-27T17:32:35+00:00","fetched_at":"2026-10-27T19:04:56+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-3098","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-3098","severity":null,"published_at":"2024-04-10T17:15:56+00:00","modified_at":"2026-06-17T07:43:18+00:00","first_seen_at":"2026-10-27T17:32:47+00:00","fetched_at":"2026-10-27T17:32:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}