CVE-2024-4343

Summary

CVE-2024-4343 is a Python command injection vulnerability affecting versions up to 0.3.0 of the imartinez/privategpt application. The vulnerability lies in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custom/sagemaker.py`. It arises due to the use of the `eval()` function to parse a string from a remote AWS SageMaker LLM endpoint into a dictionary. This method of parsing is insecure as it can execute arbitrary Python code, allowing an attacker to manipulate the response from the AWS SageMaker LLM endpoint and potentially execute commands on the hosting system. The issue has been resolved in version 0.6.0.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.