CVE-2024-45201: Llamaindex RCE Vulnerability

CVE-2024-45201 Overview

CVE-2024-45201 is a code injection vulnerability in LlamaIndex, an open-source data framework used to connect large language models to external data sources. The flaw resides in download/integration.py, which invokes an exec call constructed with a dynamic {cls_name} value during integration downloads. An attacker able to influence the class name passed into this path can execute arbitrary Python code in the process running LlamaIndex. The issue affects versions before 0.10.38 and is tracked under CWE-94: Improper Control of Generation of Code.

Critical Impact
Successful exploitation allows arbitrary code execution in the context of the LlamaIndex process, exposing model data, credentials, and connected backends.

Affected Products

LlamaIndex llama_index versions prior to 0.10.38
Applications embedding vulnerable LlamaIndex releases in retrieval-augmented generation (RAG) pipelines
AI services that dynamically download or load LlamaIndex integrations at runtime

Discovery Timeline

2024-08-22 - CVE-2024-45201 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-45201

Vulnerability Analysis

The defect is a code injection weakness in the integration-download logic. download/integration.py builds a Python statement of the form import {cls_name} and passes it to exec. When cls_name originates from attacker-controlled input, Python evaluates whatever expression the attacker embeds, not just an import statement. LlamaIndex is commonly deployed inside long-running API workers that hold credentials for vector databases, cloud object stores, and model providers, so code execution here typically extends beyond the LlamaIndex process itself.

Exploitation requires network reachability and low-privilege access to a code path that resolves a class name through the integration downloader. Once triggered, the attacker gains the confidentiality, integrity, and availability impact associated with arbitrary Python execution.

Root Cause

The root cause is unsafe use of exec on a string built with untrusted input. LlamaIndex should resolve integration classes through a validated allow-list or importlib.import_module with strict name checks. Instead, the class name is concatenated into a Python source fragment and evaluated. Any character permitted in the input, including newlines and semicolons, becomes executable code. See the fix in GitHub Pull Request #13523 and the v0.10.37 to v0.10.38 diff.

Attack Vector

An authenticated attacker submits a crafted class name to an application endpoint that invokes the integration download path. The payload contains Python code appended to or replacing the expected identifier. exec evaluates the payload with the privileges of the LlamaIndex worker. From there, the attacker can read environment variables, exfiltrate API keys for connected model providers, pivot to internal services, or persist by writing to disk.

Detection Methods for CVE-2024-45201

Indicators of Compromise

Unexpected outbound network connections initiated by Python worker processes running LlamaIndex.
New or modified files in the LlamaIndex install directory or user site-packages that were not deployed by CI/CD.
Anomalous child processes such as /bin/sh, bash, or curl spawned by the Python interpreter hosting LlamaIndex.
Log entries showing class names containing whitespace, semicolons, parentheses, or dunder attributes like __import__.

Detection Strategies

Inventory installed llama_index versions across build artifacts, container images, and running hosts, and flag any release below 0.10.38.
Instrument Python applications to log the exact cls_name values passed into download/integration.py and alert on non-identifier characters.
Correlate process-lineage telemetry from endpoint agents to detect Python spawning shells or network utilities.

Monitoring Recommendations

Monitor egress from AI workload subnets for traffic to unfamiliar destinations, particularly during model or integration loads.
Track file integrity on directories containing LlamaIndex packages and downloaded integrations.
Alert on runtime calls to exec, eval, or compile within LlamaIndex code paths using Python audit hooks (sys.addaudithook).

How to Mitigate CVE-2024-45201

Immediate Actions Required

Upgrade LlamaIndex to version 0.10.38 or later across all environments, including container base images and notebook runtimes.
Rotate any secrets, API keys, and tokens accessible to LlamaIndex workers that ran vulnerable versions.
Restrict which users and services can submit integration or class-name parameters to LlamaIndex-backed endpoints.

Patch Information

The upstream fix is included in llama_index0.10.38. Review the changes in GitHub Pull Request #13523 and validate the upgrade against the v0.10.37 to v0.10.38 release comparison. Rebuild and redeploy any container image or serverless function that pins an earlier version.

Workarounds

If patching is delayed, block calls to the integration downloader and pre-install required integrations from trusted package indexes.
Enforce strict input validation on any user-supplied identifier that reaches LlamaIndex, allowing only [A-Za-z0-9_.] characters.
Run LlamaIndex workers under least-privilege service accounts with no write access to source directories and no ambient cloud credentials.

bash

# Upgrade LlamaIndex to a fixed release
pip install --upgrade 'llama-index>=0.10.38'

# Verify the installed version
python -c "import llama_index; print(llama_index.__version__)"