PatchTheCVEprivategpt vulnerabilities and fixes
Recent CVEs affecting privategpt, with upgrade or downgrade steps. 8 tracked.
privategpt has 8 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 2. Most recent: 2025-05-10. Highest priority: CVE-2024-4343 (score 69/100).
- CVE-2025-4515 MEDIUM 4.3 UPGRADE A vulnerability, which was classified as problematic, was found in Zylon PrivateGPT up to 0.6.2
- CVE-2024-8029 MEDIUM 6.1 DOWNGRADE An XSS vulnerability was discovered in the upload file(s) process of imartinez/privategpt v0.5.0
- CVE-2024-8018 HIGH 7.5 DOWNGRADE A vulnerability in imartinez/privategpt version 0.5.0 allows for a Denial of Service (DOS) attack
- CVE-2024-5936 MEDIUM 6.1 DOWNGRADE An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'f
- CVE-2024-5935 MEDIUM 5.4 DOWNGRADE A Cross-Site Request Forgery (CSRF) vulnerability in version 0.5.0 of imartinez/privategpt allows an attacker
- CVE-2024-5186 HIGH 7.2 DOWNGRADE A Server-Side Request Forgery (SSRF) vulnerability exists in the file upload section of imartinez/privategpt v
- CVE-2024-4343 CRITICAL 9.8 UPGRADE A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./pr
- CVE-2024-12063 HIGH 7.5 DOWNGRADE A Denial of Service (DoS) vulnerability exists in the file upload feature of imartinez/privategpt version v0.6
FAQ
How do I fix privategpt vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is privategpt being exploited right now?
None of the tracked privategpt CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which privategpt CVE should I patch first?
CVE-2024-4343 currently ranks highest (69/100): A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./pr.