LLama-Index CLI --files OS Command Injection

How the attack works

An attacker invokes the llama-index CLI with a --files value that contains a shell metacharacter (like ; | & or backticks) instead of a plain filename. Because the CLI passes this value directly to os.system(), the shell interprets the metacharacter and executes an extra, attacker-controlled command. The detection confirms this by tracing the exact process that ran the CLI, following its full process lineage, and checking whether the anchor process is itself a shell invoked with -c, or whether a shell or recon/network tool spawns shortly afterward in the same session. This gives higher confidence the injection actually executed rather than just being present in a string.

Netzilo detection

Why it matters

Successful exploitation lets an attacker run arbitrary OS commands with the privileges of whatever ran the CLI, which can lead to further reconnaissance, data theft, or lateral movement from that host.

What you can do

• →Upgrade or patch the LLama-Index CLI so --files values are validated or passed without shell interpretation (avoid os.system with unsanitized input).
• →Restrict who and what can invoke the LLama-Index CLI, especially in CI/CD pipelines or automated scripts.
• →Review CI/build scripts that call the CLI for filenames or arguments built from untrusted input.
• →Monitor for shell processes spawned with -c immediately after CLI invocations, and treat unexpected child processes (shells, network tools) following a CLI call as suspicious.

Known benign look-alikes

• A real filename passed to --files that legitimately contains a shell metacharacter (for example "Q3 P&L; final.pdf" on macOS, or a path containing a pipe or angle bracket). Reported as SUSPECTED, never CONFIRMED, unless a shell or recon binary is also spawned in the same session.
• A CI/Make one-liner that chains the CLI with another command inside the same sh -c string, e.g. 'llamaindex rag --files docs/a.md docs/b.md && echo ok'. The value is truncated at the next " --", but a trailing "&& ..." after the file list still matches.
• Documentation, exploit write-ups or regression tests that echo a PoC string containing 'llamaindex --files "x; id"' - the metacharacter is inside a quoted echo argument, not a real invocation.
• Deliberate CVE reproduction in a sandbox or a red-team exercise.
• Repository paths that merely contain the token llama_index (site-packages, vendored source) combined with an unrelated --files flag on the same command line - the metacharacter check inside the --files value is what suppresses these.

References

• https://owasp.org/Top10/A03_2021-Injection/
• https://attack.mitre.org/techniques/T1059/004/
• https://docs.python.org/3/library/os.html#os.system

Related threats