CVE-2024-4343

CVE-2024-4343 is a critical Python command injection vulnerability affecting imartinez/privategpt versions up to 0.3.0. It stems from the unsafe use of the eval() function in the SagemakerLLM class, which parses responses from AWS SageMaker LLM endpoints. An attacker can manipulate these responses to inject and execute arbitrary Python code on the host system. With a CVSS score of 9.8 (CRITICAL), this vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. The FAUCET Risk Score is 80/100, indicating significant risk. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage. The issue is resolved in version 0.6.0.