Описание
The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line argument. This argument is intended to allow users to provide custom Python function definitions. However, the tool directly executes the provided code using the unsafe exec() function without any sanitization, sandboxing, or security restrictions. An attacker can exploit this by crafting a malicious llm command with arbitrary Python code in the --functions argument and using social engineering to trick a victim into running it. This leads to arbitrary code execution on the victim's system, potentially granting the attacker full control.
A flaw was found in the llm CLI tool. An attacker can exploit a code injection vulnerability by crafting a malicious command with arbitrary Python code in the --functions argument. If a victim is tricked into running this command, it leads to arbitrary code execution on their system, potentially granting the attacker full control.
Отчет
This flaw is rated as Important (CVSS 7.3) because the llm tool is a local command-line application, not a network-facing service (AV:L), and exploitation requires a local user with the tool installed (PR:L) to be socially engineered into executing a specially crafted command containing malicious Python code in the --functions argument (UI:R). Red Hat OpenShift AI (RHOAI) is not affected as the llm CLI tool is not present in RHOAI container images. Fedora ships the affected python-llm package. To reduce risk, users should run the llm tool inside a sandbox such as a container or VM. This is mainly informative.
Меры по смягчению последствий
The --functions argument in the llm CLI tool executes arbitrary Python code by design, similar to python -c. There is no built-in sandboxing or restriction on the code that can be run. To reduce the risk of exploitation, run the llm process inside a sandbox such as a container or a VM.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift AI (RHOAI) | rhoai/odh-model-controller-rhel9 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.3 High
CVSS3
Связанные уязвимости
The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line argument. This argument is intended to allow users to provide custom Python function definitions. However, the tool directly executes the provided code using the unsafe exec() function without any sanitization, sandboxing, or security restrictions. An attacker can exploit this by crafting a malicious llm command with arbitrary Python code in the --functions argument and using social engineering to trick a victim into running it. This leads to arbitrary code execution on the victim's system, potentially granting the attacker full control.
The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line argument. This argument is intended to allow users to provide custom Python function definitions. However, the tool directly executes the provided code using the unsafe exec() function without any sanitization, sandboxing, or security restrictions. An attacker can exploit this by crafting a malicious llm command with arbitrary Python code in the --functions argument and using social engineering to trick a victim into running it. This leads to arbitrary code execution on the victim's system, potentially granting the attacker full control.
The llm CLI tool thru 0.27.1 contains a critical code injection vulner ...
llm CLI tool contains a code injection vulnerability via `--functions` command-line argument
EPSS
7.3 High
CVSS3