Vulnerability	Vulnerable Version
H Improper Control of Generation of Code ('Code Injection') llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') through the `exec` call in the `download/integration.py` script. An attacker can execute arbitrary code by injecting malicious input into the `cls_name` variable used in the exec call. How to fix Improper Control of Generation of Code ('Code Injection')? Upgrade `llama-index` to version 0.10.38 or higher.	[,0.10.38)
C Command Injection llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Command Injection due to the `safe_eval` function. An attacker can execute arbitrary code on the server hosting the application by crafting input that, while not containing an underscore, still results in the execution of OS commands. How to fix Command Injection? Upgrade `llama-index` to version 0.10.24 or higher.	[,0.10.24)
H Arbitrary Code Execution llama-index is an Interface between LLMs and your data Affected versions of this package are vulnerable to Arbitrary Code Execution via the `exec` parameter in `PandasQueryEngine` function due to missing input sanitization. How to fix Arbitrary Code Execution? Upgrade `llama-index` to version 0.9.5 or higher.	[,0.9.5)

Go back to all versions of this package