---
id: CVE-2024-3121
aliases:
  - GHSA-79h8-gxhq-q3jg
  - PYSEC-2026-1584
title: Remote Code Execution in create_conda_env function in lollms
summary: Remote Code Execution in create_conda_env function in lollms
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: lollms
product: lollms
ecosystem: pip
affected:
  - lollms <= 9.5.1
published: '2024-06-24'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-79h8-gxhq-q3jg'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-3121'
  - url: 'https://github.com/ParisNeo/lollms'
  - url: 'https://huntr.com/bounties/db57c343-9b80-4c1c-9ab0-9eef92c9b27b'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.00446
epssPercentile: 0.38223
ingestedAt: '2026-07-08T18:25:46.830Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/dark-ninja10/CVE-2024-3121'
  checkedAt: '2026-09-24T07:52:51.402Z'
exploitAvailable: true
---

## Overview

A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the env_name and python_version parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the 'whoami' command among potentially other harmful commands.

## Affected packages

- `lollms <= 9.5.1`

## Remediation

Refer to the advisory for the patched release.