CVE-2024-23730: Unsafe yaml deserialization in llama-hub
(updated )
The OpenAPI and ChatGPT plugin loaders in LlamaHub (aka llama-hub) before 0.0.67 allow attackers to execute arbitrary code because safe_load is not used for YAML.
References
- github.com/advisories/GHSA-297x-2qf3-jrj3
- github.com/pypa/advisory-database/tree/main/vulns/llama-hub/PYSEC-2026-393.yaml
- github.com/run-llama/llama-hub/blob/v0.0.67/CHANGELOG.md
- github.com/run-llama/llama-hub/commit/c01416e737c7747a213a79881b8308c41d043515
- github.com/run-llama/llama-hub/pull/841/commits/9dc9c21a5c6d0226d1d2101c3121d4f085743d52
- github.com/run-llama/llama-hub/releases/tag/v0.0.67
- nvd.nist.gov/vuln/detail/CVE-2024-23730
- pypi.org/project/llama-hub
Code Behaviors & Features
Detect and mitigate CVE-2024-23730 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →