ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.
CVE-2024-45201: Code injection vulnerability in llama_index
A vulnerability in llama_index allowed arbitrary code execution through the download_integration function. The flaw was patched by removing exec functionality in version 0.10.38.
AII-1002-428932 sources ↓
What happened
A vulnerability in the download_integration function of llama_index allowed arbitrary code execution through the use of exec.
Governance controls
The vulnerability was patched by removing exec from download_integration in pull request #13523, merged on May 16, 2024, and released in version 0.10.38.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.