CVE-2024-50050mediumCode execution2024-10-23
CVE-2024-50050: Llama Stack used pickle over sockets
Meta’s Llama Stack used Python pickle to deserialise socket messages, which could allow remote code execution. It switched to JSON.
What it is
NVD: Llama Stack “used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead.”
How to check
- Run pip show llama-stack and compare with the fixed revision.
How to fix
- Upgrade llama-stack to a release after the fix (revision 7a8aa775).
pip show llama-stack | grep VersionSources
More advisories for this tool