TI-2024-02928 Aliases CVE-2024-3126 GHSA-6w8c-vq68-25hc

Command Injection in parisneo/lollms-webui

MEDIUM 41CWE-78Published 2024-05-16 · Updated 2024-08-01

Key facts

Attack vector: Local
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A command injection vulnerability exists in the 'run_xtts_api_server' function of the parisneo/lollms-webui application, specifically within the 'lollms_xtts.py' script. The vulnerability arises due to the improper neutralization of special elements used in an OS command. The affected function utilizes 'subprocess.Popen' to execute a command constructed with a Python f-string, without adequately sanitizing the 'xtts_base_url' input. This flaw allows attackers to execute arbitrary commands remotely by manipulating the 'xtts_base_url' parameter. The vulnerability affects versions up to and including the latest version before 9.5. Successful exploitation could lead to arbitrary remote code execution (RCE) on the system where the application is deployed.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01321 71st percentileScored 2026-11-08

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed parisneo/lollms-webui (parisneo): 9.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
parisneo	parisneo/lollms-webui	before 9.5	9.5	Patch available	CNA

parisneo/lollms-webui Vendorparisneo Affected before 9.5 Fixed in 9.5 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:lollms:lollms_web_ui::::::::	before 9.5	Vulnerable	Lollms

cpe:2.3:a:lollms:lollms_web_ui:*:*:*:*:*:*:*:* Versions before 9.5 Vulnerable ·Lollms

Remediation

Fix · CNA parisneo/lollms-webui (parisneo) Fixed in 9.5

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2024-05-16
parisneo/lollms-webui 9.5
3 records Highest priority Priority HIGH 2 HIGH, 1 MEDIUM
Other records, highest priority first
- TI-2024-04029 Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webuiPriority HIGH 82
- TI-2024-03205 Path Traversal in parisneo/lollms-webuiPriority HIGH 72
Show all 3 records →

Timeline

2026-10-02 Threatist record created from CVE-2024-3126
2026-10-03 Alias added: GHSA-6w8c-vq68-25hc

References

Exploit 1

https://huntr.com/bounties/0e2bec70-826e-4c24-8015-31921e23fd12

Patch 1

https://github.com/parisneo/lollms-webui/commit/41dbb1b3f2e78ea276e5269544e50514252c0c25

TI-2026-00842 Improper Access Control via Weak JWT Token in parisneo/lollms CVSS 3.0CRITICAL 9.8
TI-2024-05059 Remote Code Execution via Path Traversal in parisneo/lollms CVSS 3.0CRITICAL 9.8
TI-2024-04029 Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui CVSS 3.0CRITICAL 9.8
TI-2024-04023 Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui CVSS 3.1CRITICAL 9.8
TI-2024-03798 Arbitrary Code Execution in parisneo/lollms CVSS 3.0CRITICAL 9.8
TI-2024-02196 Arbitrary Upload & Read via Path Traversal in parisneo/lollms-webui CVSS 3.0CRITICAL 9.6

See all 83 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences