CVE-2024-4181

CVE-2024-4181 is a critical command injection vulnerability in the llama_index library (version 0.9.47), specifically within its RunGptLLM class, which is utilized by JinaAI's RunGpt framework for LLM connections. This flaw, stemming from improper use of the eval function, allows a malicious or compromised LLM hosting provider to execute arbitrary commands on a client's machine. With a CVSS score of 8.8 (High), the vulnerability presents a significant risk, enabling full control over affected client systems with low attack complexity and no user interaction required. While no active exploitation, public exploit code, or significant community discussion has been observed, the high severity warrants immediate patching to version 0.10.13 or later.