CVE-2024-4181

What it actually does

Improper use of Python eval in RunGptLLM class permits a malicious LLM provider to inject and execute arbitrary OS commands on the connecting client.

Why it matters to the business

Organizations relying on llama_index for LLM integrations face full remote takeover of client machines, resulting in data theft, service disruption, and potential supply-chain compromise of AI workloads.

How an attack unfolds

An attacker hosts or compromises an LLM endpoint used by RunGptLLM; when the client library processes a crafted response, the embedded eval executes attacker-supplied commands, granting shell access.

How to fix it

Upgrade run-llama/llama_index to version 0.10.13 or later; apply commit d73715eaf0642705583e7897c78b9c8dd2d3a7ba or 6d642a0893aced9bed026c5c15e17c41575ca024; audit all downstream dependents that pin an older revision.

How to confirm the fix worked

Verify the installed llama_index version is 0.10.13 or newer; inspect source for removal of the eval usage inside RunGptLLM; run integration tests against a controlled malicious endpoint to confirm command execution is blocked.

Typical attack path

1. Attacker registers or compromises an LLM provider reachable by the target client
2. Client configures RunGptLLM to connect to the attacker-controlled endpoint
3. Malicious provider returns a payload that reaches the vulnerable eval call
4. Arbitrary commands execute on the client with the privileges of the running process
5. Attacker establishes persistence or exfiltrates data from the compromised host

How to detect it

Search application and system logs for unexpected process creation or command execution originating from Python processes that import llama_index; review network logs for connections to untrusted LLM endpoints; inspect code for direct use of RunGptLLM with external providers.

• RunGptLLM
• llama_index.*0\.9\.47
• eval(

What your security team should do

• Immediately upgrade all instances of llama_index to a fixed revision
• Inventory and patch every project that depends on the vulnerable package
• Restrict outbound LLM endpoints to trusted providers only
• Monitor for anomalous child processes spawned by Python processes using llama_index