Critical, CVSS 9.6PyPIAmendedPublished
llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata
CVE-2024-34359 · GHSA-56xg-wfcc-g829
- Affected
- PyPI llama-cpp-python >= 0.2.30, <= 0.2.71
- Fixed in
- 0.2.72· Vendor fix available
- Issue
- llama-cpp-python depends on class Llama in llama.py to load .gguf llama.cpp or Latency Machine Learning Models. The init constructor built in the Llama takes several parameters to configure the loading and running of the model. Other than NUMA, LoRa settings, loading tokenizers, and hardware settings, init also loads the chat template from targeted .gguf 's Metadata and furtherly parses it to llamachatformat.Jinja2ChatFormatter.tochathandler() to construct the self.chathandler for this model. Nevertheless, Jinja2ChatFormatter parse the chat template within the Metadate with sandbox-less jinja2.Environment, which is furthermore rendered in call to construct the prompt of interaction. This allows jinja2 Server Side Template Injection which leads to RCE by a carefully constructed payload. Source-to-Sink llama.py - class Llama - init: In llama.py, llama-cpp-python defined the fundamental class for model initialization parsing (Including NUMA, LoRa settings, loading…
Recommended action: Upgrade to 0.2.72 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.