Code execution via evaluated LLM stream data

Code injection in LlamaIndex before 0.10.13 allows remote attackers controlling an LLM provider to execute code on client machines. RunGptLLM's stream_complete and stream_chat methods pass provider-controlled item.data values to Python eval() instead of converting the returned mapping directly. Execution requires an application to use the RunGPT integration and process a streaming response from a malicious or compromised provider, granting that provider the client's process privileges.