CVE-2024-3271: Llamaindex Command Injection RCE Vulnerability

CVE-2024-3271 Overview

A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the intended security mechanism, which checks for the presence of underscores in code generated by LLM, to execute arbitrary code. This is achieved by crafting input that does not contain an underscore but still results in the execution of OS commands. The vulnerability allows for remote code execution (RCE) on the server hosting the application.

Critical Impact

This vulnerability enables attackers to achieve full remote code execution on servers running LlamaIndex applications, potentially compromising the entire system and any data processed by the LLM framework.

Affected Products

• LlamaIndex (llamaindex) - All versions prior to the security patch
• Applications built using the LlamaIndex framework with safe_eval functionality
• Server deployments utilizing LlamaIndex for LLM-powered applications

Discovery Timeline

• 2024-04-16 - CVE-2024-3271 published to NVD
• 2025-07-30 - Last updated in NVD database

Technical Details for CVE-2024-3271

Vulnerability Analysis

The vulnerability resides in the safe_eval function within the LlamaIndex repository. This function was designed to provide a security layer when evaluating code generated by Large Language Models (LLMs). The security mechanism relies on detecting underscore characters in the generated code to prevent access to Python's special attributes and methods (such as __class__, __import__, __builtins__) that could be leveraged for malicious purposes.

However, this underscore-based filtering approach is fundamentally flawed and can be bypassed. Attackers can craft input payloads that avoid using underscore characters while still achieving arbitrary code execution through alternative Python syntax and methods. Once the security check is bypassed, the attacker gains the ability to execute arbitrary OS commands on the server hosting the LlamaIndex application.

The vulnerability is classified as CWE-77 (Command Injection), indicating improper neutralization of special elements used in a command. Given the network-accessible nature of LlamaIndex applications and the lack of required privileges or user interaction for exploitation, this vulnerability presents a significant risk to deployed systems.

Root Cause

The root cause of this vulnerability is an insufficient security control implementation in the safe_eval function. The function relies solely on checking for underscore characters to prevent malicious code execution, which is an easily bypassable restriction. Python offers numerous ways to access dangerous functions and execute system commands without explicitly using underscore characters. This represents a classic case of blacklist-based security that fails to account for all possible attack vectors.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Submitting crafted input to an LlamaIndex-powered application
2. The malicious input is processed by the LLM and generates code that passes through safe_eval
3. The crafted payload bypasses the underscore check while still containing executable commands
4. The safe_eval function executes the malicious code, resulting in OS command execution

The attack can be performed remotely against any exposed LlamaIndex application that utilizes the vulnerable safe_eval function, potentially resulting in complete server compromise.

Detection Methods for CVE-2024-3271

Indicators of Compromise

• Unusual process spawning from Python processes running LlamaIndex applications
• Unexpected outbound network connections from application servers
• Anomalous command execution patterns in system logs
• Evidence of reconnaissance commands (whoami, id, uname) in process auditing logs

Detection Strategies

• Monitor application logs for unusual code evaluation patterns or errors from the safe_eval function
• Implement runtime application self-protection (RASP) to detect code injection attempts
• Deploy network intrusion detection systems to identify command and control traffic
• Enable command-line process auditing on servers hosting LlamaIndex applications

Monitoring Recommendations

• Configure centralized logging for all LlamaIndex application servers
• Set up alerts for process creation events originating from the application runtime
• Monitor for file system changes in application directories and sensitive system paths
• Implement egress traffic monitoring to detect potential data exfiltration attempts

How to Mitigate CVE-2024-3271

Immediate Actions Required

• Update LlamaIndex to the patched version immediately
• Audit all deployed applications for usage of the vulnerable safe_eval function
• Implement network segmentation to limit the blast radius of potential compromises
• Review application logs for any evidence of exploitation attempts

Patch Information

The LlamaIndex development team has addressed this vulnerability through a security commit that improves the code evaluation security mechanism. Organizations should update to the latest version of LlamaIndex that includes this fix. The commit hash 5fbcb5a8b9f20f81b791c7fc8849e352613ab475 contains the security patch.

Additional technical details about this vulnerability are available through the Huntr security bounty program.

Workarounds

• Disable or remove usage of the safe_eval function until patching is complete
• Implement strict input validation and sanitization before any code evaluation
• Deploy Web Application Firewall (WAF) rules to filter potentially malicious inputs
• Run LlamaIndex applications in sandboxed environments with minimal system privileges
• Consider using containerization with restricted capabilities to limit command execution impact

# Configuration example - Run LlamaIndex in a restricted container
docker run --rm \
  --read-only \
  --cap-drop=ALL \
  --security-opt=no-new-privileges:true \
  --network=internal-only \
  llamaindex-app:latest