PYSEC-2023-148

vendorUSosv

view advisory published 2023-08-15Licence: CC-BY-4.0

An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-39662US	critical9.8	1.49% (74th)	—	2023-08-15
An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function.

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-2xxc-73fv-36f7ADVISORY
https://github.com/jerryjliu/llama_index/issues/7054REPORT

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan