CVE-2024-1520

CRITICAL

lollms_web_ui 9.0-<9.2 - OS Command Injection via Discussion ID Parameter

Title source: llm
STIX 2.1

Description

An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-supplied input in the 'discussion_id' parameter. Attackers can exploit this vulnerability by injecting malicious OS commands, leading to unauthorized command execution on the underlying operating system. This could result in unauthorized access, data leakage, or complete system compromise.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.4821
EPSS Percentile 98.7%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-78
Status published
Products (1)
lollms/lollms_web_ui 9.0 - 9.2
Published Apr 10, 2024
Tracked Since Feb 18, 2026