Critical github · GHSA-297x-2qf3-jrj3

Unsafe yaml deserialization in llama-hub

Published Jan 21, 2024 CVSS 9.8

The OpenAPI and ChatGPT plugin loaders in LlamaHub (aka llama-hub) before 0.0.67 allow attackers to execute arbitrary code because safe_load is not used for YAML.

Remote Code Execution

Affected AI Products

chatgpt llama

View original source

Get the weekly digest. Every Monday: top AI security stories of the week. Free.