Description
An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | llama-index | < 0.9.14 | 0.9.14 | GHSA-2xxc-73fv-36f7 |
| PyPI | llama-index | < 0.7.14 | 0.7.14 | PYSEC-2023-148 |