CRITICAL9.8

PYSEC-2023-148

Quick fix

PYSEC-2023-148 — llama-index: upgrade to the fixed version with the command below.

pip install --upgrade 'llama-index>=0.7.14'

Details

An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/llama-index

Introduced in: 0Fixed in: 0.7.14

Fixpip install --upgrade 'llama-index>=0.7.14'

References

https://github.com/jerryjliu/llama_index/issues/7054[EVIDENCE]
https://github.com/jerryjliu/llama_index/issues/7054[REPORT]
https://github.com/advisories/GHSA-2xxc-73fv-36f7[ADVISORY]