---
title: "Security digest: January 21, 2024"
url: https://erroneo.us/security/2024-01-21/
description: "January 21, 2024 vulnerability digest: 5 critical advisories (PyPI, Maven). What to patch and who can relax."
type: security-digest-day
section: "Security Digest"
date_published: 2024-01-21
date_modified: 2024-01-21
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: January 21, 2024

5 critical advisories.

## Take stock

- PyPI: 4 critical advisories ( embedchain , pandasai , llama-index , llama-hub ). Check with pip-audit (or: pip show <package>) .
- Maven: 1 critical advisory ( org.clojure:clojure ). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId> .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

None.

## Critical advisories

- [CVE-2024-23731](https://erroneo.us/security/cve/CVE-2024-23731/index.md) Code execution in Embedchain — PyPI embedchain < 0.1.57 → 0.1.57
- [CVE-2017-20189](https://erroneo.us/security/cve/CVE-2017-20189/index.md) Clojure classes can be used to craft a serialized object that runs arbitrary code on deserialization — Maven org.clojure:clojure < 1.9.0 → 1.9.0
- [CVE-2024-23752](https://erroneo.us/security/cve/CVE-2024-23752/index.md) Code execution in pandasai — PyPI pandasai <= 1.5.17 → no fix
- [CVE-2024-23751](https://erroneo.us/security/cve/CVE-2024-23751/index.md) SQL injection in llama-index — PyPI llama-index <= 0.9.35 → no fix
- [CVE-2024-23730](https://erroneo.us/security/cve/CVE-2024-23730/index.md) Unsafe yaml deserialization in llama-hub — PyPI llama-hub < 0.0.67 → 0.0.67

---
Source page: https://erroneo.us/security/2024-01-21/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt