deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-31297
Published: 2024-04-10
Description: Missing Authorization vulnerability in WPExperts Wholesale For WooCommerce.This issue affects Wholesale For WooCommerce: from n/a through 2.3.0.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862, CWE-862
References: https://patchstack.com/database/vulnerability/woocommerce-wholesale-pricing/wordpress-wholesale-for-woocommerce-plugin-2-3-1-unauthenticated-arbitrary-post-page-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/woocommerce-wholesale-pricing/wordpress-wholesale-for-woocommerce-plugin-2-3-1-unauthenticated-arbitrary-post-page-vulnerability?_s_id=cve
CVE: CVE-2024-31298
Published: 2024-04-10
Description: Insertion of Sensitive Information into Log File vulnerability in Joel Hardi User Spam Remover.This issue affects User Spam Remover: from n/a through 1.0.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://patchstack.com/database/vulnerability/user-spam-remover/wordpress-user-spam-remover-plugin-1-0-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/user-spam-remover/wordpress-user-spam-remover-plugin-1-0-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve
CVE: CVE-2024-31302
Published: 2024-04-10
Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in CodePeople Contact Form Email.This issue affects Contact Form Email: from n/a through 1.3.44.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://patchstack.com/database/vulnerability/contact-form-to-email/wordpress-contact-form-email-plugin-1-3-44-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/contact-form-to-email/wordpress-contact-form-email-plugin-1-3-44-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-31353
Published: 2024-04-10
Description: Insertion of Sensitive Information into Log File vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-532
References: https://patchstack.com/database/vulnerability/slideshow-gallery/wordpress-slideshow-gallery-lite-plugin-1-7-8-sensitive-data-exposure-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/slideshow-gallery/wordpress-slideshow-gallery-lite-plugin-1-7-8-sensitive-data-exposure-vulnerability?_s_id=cve
CVE: CVE-2024-31358
Published: 2024-04-10
Description: Missing Authorization vulnerability in Saleswonder Team: Tobias 5 Stars Rating Funnel 5-stars-rating-funnel.This issue affects 5 Stars Rating Funnel: from n/a through <= 1.2.67.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/Wordpress/Plugin/5-stars-rating-funnel/vulnerability/wordpress-5-stars-rating-funnel-plugin-1-2-67-arbitrary-content-deletion-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/5-stars-rating-funnel/wordpress-5-stars-rating-funnel-plugin-1-2-67-arbitrary-content-deletion-vulnerability?_s_id=cve
CVE: CVE-2024-31871
Published: 2024-04-10
Description: IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deploying Python scripts due to improper certificate validation.  IBM X-Force ID:  287306.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/287306; https://www.ibm.com/support/pages/node/7147932; http://seclists.org/fulldisclosure/2024/Nov/1
CVE: CVE-2024-31872
Published: 2024-04-10
Description: IBM Security Verify Access Appliance 10.0.0 through 10.0.7 could allow a malicious actor to conduct a man in the middle attack when deploying Open Source scripts due to missing certificate validation.  IBM X-Force ID:  287316.
CVSS Score: 7.5 (HIGH)
CWE: CWE-295
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/287316; https://www.ibm.com/support/pages/node/7147932; http://seclists.org/fulldisclosure/2024/Nov/1
CVE: CVE-2024-31873
Published: 2024-04-10
Description: IBM Security Verify Access Appliance 10.0.0 through 10.0.7 contains hard-coded credentials which it uses for its own inbound authentication that could be obtained by a malicious actor.  IBM X-Force ID:  287317.


CVSS Score: 7.5 (HIGH)
CWE: CWE-798
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/287317; https://www.ibm.com/support/pages/node/7147932; http://seclists.org/fulldisclosure/2024/Nov/1
CVE: CVE-2024-31874
Published: 2024-04-10
Description: IBM Security Verify Access Appliance 10.0.0 through 10.0.7 uses uninitialized variables when deploying that could allow a local user to cause a denial of service.   IBM X-Force ID:  287318.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-457, CWE-908
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/287318; https://www.ibm.com/support/pages/node/7147932; http://seclists.org/fulldisclosure/2024/Nov/1
CVE: CVE-2024-3566
Published: 2024-04-10
Description: A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-77
References: https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/; https://kb.cert.org/vuls/id/123335; https://learn.microsoft.com/en-us/archive/blogs/twistylittlepassagesallalike/everyone-quotes-command-line-arguments-the-wrong-way
CVE: CVE-2024-1511
Published: 2024-04-10
Description: The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allows an unauthenticated attacker to read, write, and in certain configurations execute arbitrary files on the server by exploiting various endpoints. The vulnerability can be exploited even when the service is bound to localhost, through cross-site requests facilitated by malicious HTML/JS pages.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://huntr.com/bounties/62b77589-772d-4d6e-aef4-2aec4cfe5f8b; https://huntr.com/bounties/62b77589-772d-4d6e-aef4-2aec4cfe5f8b
CVE: CVE-2024-1520
Published: 2024-04-10
Description: An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-supplied input in the 'discussion_id' parameter. Attackers can exploit this vulnerability by injecting malicious OS commands, leading to unauthorized command execution on the underlying operating system. This could result in unauthorized access, data leakage, or complete system compromise.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/parisneo/lollms-webui/commit/2497d1a4fe5a09f003bf7a9bc426139e9295a934; https://huntr.com/bounties/405c2059-3fe9-4233-8eed-741ec847d181; https://github.com/parisneo/lollms-webui/commit/2497d1a4fe5a09f003bf7a9bc426139e9295a934
CVE: CVE-2024-1599
Published: 2024-04-10
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-1600
Published: 2024-04-10
Description: A Local File Inclusion (LFI) vulnerability exists in the parisneo/lollms-webui application, specifically within the `/personalities` route. An attacker can exploit this vulnerability by crafting a URL that includes directory traversal sequences (`../../`) followed by the desired system file path, URL encoded. Successful exploitation allows the attacker to read any file on the filesystem accessible by the web server. This issue arises due to improper control of filename for include/require statement in the application.
CVSS Score: 9.3 (CRITICAL)
CWE: CWE-98
References: https://github.com/parisneo/lollms-webui/commit/49b0332e98d42dd5204dda53dee410b160106265; https://huntr.com/bounties/29ec621a-bd69-4225-ab0f-5bb8a1d10c67; https://github.com/parisneo/lollms-webui/commit/49b0332e98d42dd5204dda53dee410b160106265
CVE: CVE-2024-1602
Published: 2024-04-10
Description: parisneo/lollms-webui is vulnerable to stored Cross-Site Scripting (XSS) that leads to Remote Code Execution (RCE). The vulnerability arises due to inadequate sanitization and validation of model output data, allowing an attacker to inject malicious JavaScript code. This code can be executed within the user's browser context, enabling the attacker to send a request to the `/execute_code` endpoint and establish a reverse shell to the attacker's host. The issue affects various components of the application, including the handling of user input and model output.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://huntr.com/bounties/59be0d5a-f18e-4418-8f29-72320269a097; https://huntr.com/bounties/59be0d5a-f18e-4418-8f29-72320269a097
CVE: CVE-2024-1625
Published: 2024-04-10
Description: An Insecure Direct Object Reference (IDOR) vulnerability exists in the lunary-ai/lunary application version 0.3.0, allowing unauthorized deletion of any organization's project. The vulnerability is due to insufficient authorization checks in the project deletion endpoint, where the endpoint fails to verify if the project ID provided in the request belongs to the requesting user's organization. As a result, an attacker can delete projects belonging to any organization by sending a crafted DELETE request with the target project's ID. This issue affects the project deletion functionality implemented in the projects.delete route.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-639, CWE-639
References: https://github.com/lunary-ai/lunary/commit/88f98e29f19da9d1f5de45c5b163fd5b48e0bcec; https://huntr.com/bounties/cf6dd625-e6c9-44df-a[PII_REDACTED]6de21; https://github.com/lunary-ai/lunary/commit/88f98e29f19da9d1f5de45c5b163fd5b48e0bcec
CVE: CVE-2024-1643
Published: 2024-04-10
Description: By knowing an organization's ID, an attacker can join the organization without permission and gain the ability to read and modify all data within that organization. This vulnerability allows unauthorized access and modification of sensitive information, posing a significant security risk. The flaw is due to insufficient verification of user permissions when joining an organization.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-200
References: https://github.com/lunary-ai/lunary/commit/67eaefe1c77c882c628780940c704a117b561d51; https://huntr.com/bounties/ce2563a2-3d81-4e2e-954e-abecb9332416; https://github.com/lunary-ai/lunary/commit/67eaefe1c77c882c628780940c704a117b561d51
CVE: CVE-2024-1728
Published: 2024-04-10
Description: gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. Attackers can exploit this vulnerability to read arbitrary files on the filesystem, such as private SSH keys, by manipulating the file path in the request to the `/queue/join` endpoint. This issue could potentially lead to remote code execution. The vulnerability is present in the handling of file upload paths, allowing attackers to redirect file uploads to unintended locations on the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/gradio-app/gradio/commit/16fbe9cd0cffa9f2a824a0165beb43446114eec7; https://huntr.com/bounties/9bb33b71-7995-425d-91cc-2c2a2f2a068a; https://github.com/gradio-app/gradio/commit/16fbe9cd0cffa9f2a824a0165beb43446114eec7
CVE: CVE-2024-1740
Published: 2024-04-10
Description: In lunary-ai/lunary version 1.0.1, a vulnerability exists where a user removed from an organization can still read, create, modify, and delete logs by re-using an old authorization token. The lunary web application communicates with the server using an 'Authorization' token in the browser, which does not properly invalidate upon the user's removal from the organization. This allows the removed user to perform unauthorized actions on logs and access project and external user details without valid permissions.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863
References: https://github.com/lunary-ai/lunary/commit/c57cd50fa0477fd2a2efe60810c0099eebd66f54; https://huntr.com/bounties/c1a51f71-628e-4eb5-ac35-50bf64832cfd; https://github.com/lunary-ai/lunary/commit/c57cd50fa0477fd2a2efe60810c0099eebd66f54
CVE: CVE-2024-1741
Published: 2024-04-10
Description: lunary-ai/lunary version 1.0.1 is vulnerable to improper authorization, allowing removed members to read, create, modify, and delete prompt templates using an old authorization token. Despite being removed from an organization, these members can still perform operations on prompt templates by sending HTTP requests with their previously captured authorization token. This issue exposes organizations to unauthorized access and manipulation of sensitive template data.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-863, CWE-863
References: https://github.com/lunary-ai/lunary/commit/d8e2e73efd53ab4e92cf47bbf4b639a9f08853d2; https://huntr.com/bounties/671bd040-1cc5-4227-8182-5904e9c5ed3b; https://github.com/lunary-ai/lunary/commit/d8e2e73efd53ab4e92cf47bbf4b639a9f08853d2
CVE: CVE-2024-1902
Published: 2024-04-10
Description: lunary-ai/lunary is vulnerable to a session reuse attack, allowing a removed user to change the organization name without proper authorization. The vulnerability stems from the lack of validation to check if a user is still part of an organization before allowing them to make changes. An attacker can exploit this by using an old authorization token to send a PATCH request, modifying the organization's name even after being removed from the organization. This issue is due to incorrect synchronization and affects the orgs.patch route.
CVSS Score: 7.5 (HIGH)
CWE: CWE-821
References: https://github.com/lunary-ai/lunary/commit/d8e2e73efd53ab4e92cf47bbf4b639a9f08853d2; https://huntr.com/bounties/e536310e-abe7-4585-9cf6-21f77390a5e8; https://github.com/lunary-ai/lunary/commit/d8e2e73efd53ab4e92cf47bbf4b639a9f08853d2
CVE: CVE-2024-2029
Published: 2024-04-10
Description: A command injection vulnerability exists in the `TranscriptEndpoint` of mudler/localai, specifically within the `audioToWav` function used for converting audio files to WAV format for transcription. The vulnerability arises due to the lack of sanitization of user-supplied filenames before passing them to ffmpeg via a shell command, allowing an attacker to execute arbitrary commands on the host system. Successful exploitation could lead to unauthorized access, data breaches, or other detrimental impacts, depending on the privileges of the process executing the code.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/mudler/localai/commit/31a4c9c9d3abc58de2bdc[PII_REDACTED]c8b33eb1c; https://huntr.com/bounties/e092528a-ce3b-4e66-9b98-3f56d6b276b0; https://github.com/mudler/localai/commit/31a4c9c9d3abc58de2bdc[PII_REDACTED]c8b33eb1c
CVE: CVE-2024-2195
Published: 2024-04-10
Description: A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/run/` endpoint, affecting versions >= 3.0.0. The vulnerability resides in the `run_search_api` function of the `aim/web/api/runs/views.py` file, where improper restriction of user access to the `RunView` object allows for the execution of arbitrary code via the `query` parameter. This issue enables attackers to execute arbitrary commands on the server, potentially leading to full system compromise.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://huntr.com/bounties/22f2355e-b875-4c01-b454-327e5951c018; https://huntr.com/bounties/22f2355e-b875-4c01-b454-327e5951c018
CVE: CVE-2024-2196
Published: 2024-04-10
Description: aimhubio/aim is vulnerable to Cross-Site Request Forgery (CSRF), allowing attackers to perform actions such as deleting runs, updating data, and stealing data like log records and notes without the user's consent. The vulnerability stems from the lack of CSRF and CORS protection in the aim dashboard. An attacker can exploit this by tricking a user into executing a malicious script that sends unauthorized requests to the aim server, leading to potential data loss and unauthorized data manipulation.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://huntr.com/bounties/e141e3f2-afbb-405f-a891-f66628c8b68f; https://huntr.com/bounties/e141e3f2-afbb-405f-a891-f66628c8b68f
CVE: CVE-2024-2217
Published: 2024-04-10
Description: gaizhenbiao/chuanhuchatgpt is vulnerable to improper access control, allowing unauthorized access to the `config.json` file. This vulnerability is present in both authenticated and unauthenticated versions of the application, enabling attackers to obtain sensitive information such as API keys (`openai_api_key`, `google_palm_api_key`, `xmchat_api_key`, etc.), configuration details, and user credentials. The issue stems from the application's handling of HTTP requests for the `config.json` file, which does not properly restrict access based on user authentication.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: https://github.com/gaizhenbiao/chuanhuchatgpt/commit/c5ae3b5ae6b47259e0ce8730e0a47e85121f4a7d; https://huntr.com/bounties/e4df74bf-b2ee-490f-a9c9-e5c8010b8b29; https://github.com/gaizhenbiao/chuanhuchatgpt/commit/c5ae3b5ae6b47259e0ce8730e0a47e85121f4a7d
CVE: CVE-2024-2221
Published: 2024-04-10
Description: qdrant/qdrant is vulnerable to a path traversal and arbitrary file upload vulnerability via the `/collections/{COLLECTION}/snapshots/upload` endpoint, specifically through the `snapshot` parameter. This vulnerability allows attackers to upload and overwrite any file on the filesystem, leading to potential remote code execution. This issue affects the integrity and availability of the system, enabling unauthorized access and potentially causing the server to malfunction.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434, CWE-22, CWE-434
References: https://github.com/qdrant/qdrant/commit/e6411907f0ecf3c2f8ba44ab704b9e4597d9705d; https://huntr.com/bounties/6be8d4e3-67e6-4660-a8db-04215a1cff3e; https://github.com/qdrant/qdrant/commit/e6411907f0ecf3c2f8ba44ab704b9e4597d9705d
CVE: CVE-2024-2952
Published: 2024-04-10
Description: BerriAI/litellm is vulnerable to Server-Side Template Injection (SSTI) via the `/completions` endpoint. The vulnerability arises from the `hf_chat_template` method processing the `chat_template` parameter from the `tokenizer_config.json` file through the Jinja template engine without proper sanitization. Attackers can exploit this by crafting malicious `tokenizer_config.json` files that execute arbitrary code on the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-76
References: https://github.com/berriai/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3; https://huntr.com/bounties/a9e0a164-6de0-43a4-a640-0cbfb54220a4; https://github.com/berriai/litellm/commit/8a1cdc901708b07b7ff4eca20f9cb0f1f0e8d0b3
CVE: CVE-2024-31299
Published: 2024-04-10
Description: Cross-Site Request Forgery (CSRF) vulnerability in Reservation Diary ReDi Restaurant Reservation allows Cross-Site Scripting (XSS).This issue affects ReDi Restaurant Reservation: from n/a through 24.0128.
CVSS Score: 7.1 (HIGH)
CWE: CWE-352
References: https://patchstack.com/database/vulnerability/redi-restaurant-reservation/wordpress-redi-restaurant-reservation-plugin-24-0128-cross-site-request-forgery-csrf-to-xss-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/redi-restaurant-reservation/wordpress-redi-restaurant-reservation-plugin-24-0128-cross-site-request-forgery-csrf-to-xss-vulnerability?_s_id=cve
CVE: CVE-2024-31342
Published: 2024-04-10
Description: Missing Authorization vulnerability in WPcloudgallery WordPress Gallery Exporter.This issue affects WordPress Gallery Exporter: from n/a through 1.3.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/wp-gallery-exporter/wordpress-gallery-exporter-plugin-1-3-arbitrary-file-download-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/wp-gallery-exporter/wordpress-gallery-exporter-plugin-1-3-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2024-31343
Published: 2024-04-10
Description: Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 4.10.1.
CVSS Score: 7.5 (HIGH)
CWE: CWE-862
References: https://patchstack.com/database/vulnerability/mp3-music-player-by-sonaar/wordpress-mp3-audio-player-for-music-radio-podcast-by-sonaar-plugin-4-10-1-arbitrary-file-download-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/mp3-music-player-by-sonaar/wordpress-mp3-audio-player-for-music-radio-podcast-by-sonaar-plugin-4-10-1-arbitrary-file-download-vulnerability?_s_id=cve
CVE: CVE-2024-31355
Published: 2024-04-10
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery.This issue affects Slideshow Gallery: from n/a through 1.7.8.
CVSS Score: 8.5 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/slideshow-gallery/wordpress-slideshow-gallery-lite-plugin-1-7-8-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/slideshow-gallery/wordpress-slideshow-gallery-lite-plugin-1-7-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-31356
Published: 2024-04-10
Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log.This issue affects User Activity Log: from n/a through 1.8.
CVSS Score: 7.6 (HIGH)
CWE: CWE-89
References: https://patchstack.com/database/vulnerability/user-activity-log/wordpress-user-activity-log-plugin-1-8-sql-injection-vulnerability?_s_id=cve; https://patchstack.com/database/vulnerability/user-activity-log/wordpress-user-activity-log-plugin-1-8-sql-injection-vulnerability?_s_id=cve
CVE: CVE-2024-3025
Published: 2024-04-10
Description: mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. Attackers can exploit this vulnerability by manipulating the logo filename to reference files outside of the restricted directory. This can lead to unauthorized reading or deletion of files by utilizing the `/api/system/upload-logo` and `/api/system/logo` endpoints. The issue stems from the lack of filtering or validation on the logo filename, allowing attackers to target sensitive files such as the application's database.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-23
References: https://github.com/mintplex-labs/anything-llm/commit/7de23dbb2da932fbfb39f56d981784d3702cf5ce; https://huntr.com/bounties/fb09a352-1016-4481-ae88-7460e2b6062b; https://github.com/mintplex-labs/anything-llm/commit/7de23dbb2da932fbfb39f56d981784d3702cf5ce
CVE: CVE-2024-3098
Published: 2024-04-10
Description: A vulnerability was identified in the `exec_utils` class of the `llama_index` package, specifically within the `safe_eval` function, allowing for prompt injection leading to arbitrary code execution. This issue arises due to insufficient validation of input, which can be exploited to bypass method restrictions and execute unauthorized code. The vulnerability is a bypass of the previously addressed CVE-2023-39662, demonstrated through a proof of concept that creates a file on the system by exploiting the flaw.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/run-llama/llama_index/commit/5fbcb5a8b9f20f81b791c7fc8849e352613ab475; https://huntr.com/bounties/1bce0d61-ad03-4b22-bc32-8f99f92974e7; https://github.com/run-llama/llama_index/commit/5fbcb5a8b9f20f81b791c7fc8849e352613ab475