PatchTheCVECVE-2024-4343: A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./pr
CVE-2024-4343 is a critical-severity flaw (CVSS 9.8) affecting privategpt. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custom/sagemaker.py` of the imartinez/privategpt application, versions up to and including 0.3.0. The vulnerability arises due to the use of the `eval()` function to parse a string received from a remote AWS SageMaker LLM endpoint into a dictionary. This method of parsing is unsafe as it can execute arbitrary Pyth
Why this priority
- Critical severity
- Public exploit reference
- CISA SSVC: automatable with total technical impact
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 2.7% (top 14%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2024-11-14 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Exact fixes by distribution
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-4343?
privategpt: upgrade to 0.6.0. Exact commands for each OS are on this page.
Is CVE-2024-4343 being exploited?
CVE-2024-4343 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-4343 affect?
CVE-2024-4343 affects privategpt. Severity is critical (CVSS 9.8). A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custom/sagemaker.py` of the imartinez/privategpt application, versions up to and including 0.3.0. The vul
How urgent is CVE-2024-4343?
Priority 69/100. Critical severity; Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action
Software pages
Python vulnerabilities · AWS vulnerabilities
Related CVEs
- CVE-2025-4515 MEDIUM 4.3 UPGRADE A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2
- CVE-2024-8029 MEDIUM 6.1 DOWNGRADE An XSS vulnerability was discovered in the upload file(s) process of imartinez/privategpt v0.5.0
- CVE-2024-8018 HIGH 7.5 DOWNGRADE A vulnerability in imartinez/privategpt version 0.5.0 allows for a Denial of Service (DOS) attack
- CVE-2024-5936 MEDIUM 6.1 DOWNGRADE An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'f
- CVE-2024-5935 MEDIUM 5.4 DOWNGRADE A Cross-Site Request Forgery (CSRF) vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker