CVE-2023-39662

CriticalCVSS 9.8

Published: 15/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.23%

65th percentile - higher than 65% of all known CVEs

Summary

Versions of llama_index up to 0.7.13 contain a vulnerability that allows a remote attacker to execute arbitrary code via the `exec` parameter in the PandasQueryEngine function.

Risk Assessment

An attacker could exploit this vulnerability to remotely execute code, potentially leading to system compromise or data leakage.

Recommendation

It is recommended to upgrade to version 0.7.14 or later to mitigate this vulnerability.

Original NVD description (English source)

An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function.