CVE-2024-4078Critical· 9.8▾ MidnightLoLLMS Command Injection vulnerability
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.9%
0.9% → 0.9%
A vulnerability in the parisneo/lollms, specifically in the /unInstall_binding endpoint, allows for arbitrary code execution due to insufficient sanitization of user input. The issue arises from the lack of path sanitization when handling the name parameter in the unInstall_binding function, allowing an attacker to traverse directories and execute arbitrary code by loading a malicious __init__.py file. This vulnerability affects the latest version of the software. The exploitation of this vulnerability could lead to remote code execution on the system where parisneo/lollms is deployed.
lollms < 9.5.0Upgrade to a patched release:
lollms 9.5.0Connected by shared product, vendor, weakness, or advisory.
CVE-2024-5824High· 7.4lollms path traversal vulnerability allows overriding of config.yaml file, leading to RCE
CVE-2026-1114Critical· 9.8LoLLMs is vulnerable to Improper Access Control through weak secret key
CVE-2024-6281High· 7.3LoLLMS vulnerable to Expected Behavior Violation
CVE-2026-1117High· 8.2Lollms has an Improper Access Control vulnerability
CVE-2024-3429Critical· 9.8LoLLMS Path Traversal vulnerability
CVE-2026-1116Medium· 6.1A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms pr…