CVE-2024-4343: Python Command Injection in imartinez/privategpt
First published: Thu Nov 14 2024(Updated: )
A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custom/sagemaker.py` of the imartinez/privategpt application, versions up to and including 0.3.0. The vulnerability arises due to the use of the `eval()` function to parse a string received from a remote AWS SageMaker LLM endpoint into a dictionary. This method of parsing is unsafe as it can execute arbitrary Python code contained within the response. An attacker can exploit this vulnerability by manipulating the response from the AWS SageMaker LLM endpoint to include malicious Python code, leading to potential execution of arbitrary commands on the system hosting the application. The issue is fixed in version 0.6.0.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| imartinez privategpt | <=0.3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-4343?
CVE-2024-4343 is classified as a critical vulnerability due to its potential for command injection.
How do I fix CVE-2024-4343?
To mitigate CVE-2024-4343, update the imartinez/privategpt application to version 0.3.1 or later.
What versions are affected by CVE-2024-4343?
CVE-2024-4343 affects imartinez/privategpt application versions up to and including 0.3.0.
What type of vulnerability is CVE-2024-4343?
CVE-2024-4343 is a command injection vulnerability found in the `complete()` method of the `SagemakerLLM` class.
How can I identify if my system is vulnerable to CVE-2024-4343?
Check if your implementation of the imartinez/privategpt application is running version 0.3.0 or earlier.
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/severity
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/imartinez
- canonical/imartinez privategpt