---
id: "CVE-2024-3098"
kind: "vulnerability"
aliases: ["CVE-2024-3098", "GHSA-wvpx-g427-q9wc"]
title: "llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution"
severity: "critical"
cvss: 9.8
epss: 0.00959
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "llama-index-core", "fixed": ["0.10.24"], "affected": "< 0.10.24", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ai-apps", "ai-tooling", "cwe-94", "llama-index", "python", "rag", "self-hosted"]
not_affected_if: ["no-code-evaluation-path"]
published_at: "2024-04-10T17:15:56+00:00"
first_seen_at: "2026-10-27T17:32:35+00:00"
updated_at: "2026-10-27T17:36:17+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-wvpx-g427-q9wc", "first_seen_at": "2026-10-27T17:32:35+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3098", "first_seen_at": "2026-10-27T17:32:47+00:00"}]
---

# llama-index-core Prompt Injection vulnerability leading to Arbitrary Code Execution

llama-index-core's exec_utils safe_eval function fails to block some code, so a prompt that reaches the pipeline can make the library run attacker-chosen code. The sources cite a proof of concept that writes a file on the host, and the flaw bypasses an earlier fix for CVE-2023-39662.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:llama-index-core affected < 0.10.24 fixed 0.10.24

## How to check

- Run `pip show llama-index-core` and compare the version with `0.10.24`
- Search the project lockfiles for `llama-index-core` below `0.10.24`

## Fix

- Upgrade `llama-index-core` to `0.10.24` or later
- Rebuild and redeploy services that bundle the library so the fixed version ships

## Timeline

- 2026-10-27T17:32:35+00:00 ghsa https://github.com/advisories/GHSA-wvpx-g427-q9wc
- 2026-10-27T17:32:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-3098

## From the sources

A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code. The vulnerability is a bypass of the previously addressed CVE-2023-39662, demonstrated through a proof of concept that creates a file on the system by exploiting the flaw.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_