Read the docs
TI-2024-32960 Aliases CVE-2024-49375GHSA-cpv4-ggrr-7j9v

Remote Code Execution via Remote Model Loading in Rasa

Priority MEDIUM 49CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

Open source machine learning framework. A vulnerability has been identified in Rasa that enables an attacker who has the ability to load a maliciously crafted model remotely into a Rasa instance to achieve Remote Code Execution. The prerequisites for this are: 1. The HTTP API must be enabled on the Rasa instance eg with `--enable-api`. This is not the default configuration. 2. For unauthenticated RCE to be exploitable, the user must not have configured any authentication or other security controls recommended in our documentation. 3. For authenticated RCE, the attacker must posses a valid authentication token or JWT to interact with the Rasa API. This issue has been addressed in rasa version 3.6.21 and all users are advised to upgrade. Users unable to upgrade should ensure that they require authentication and that only trusted users are given access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00937 61st percentileScored 2026-11-07
Fix Fixed rasa-pro-security-advisories (RasaHQ): 3.6.21rasa-pro (PyPI): 3.10.12, 3.9.16, 3.8.18+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
RasaHQrasa-pro-security-advisoriesbefore 3.6.213.6.21Patch availableCNA
—rasa-pro (PyPI)3.10.0 to before 3.10.123.10.12Patch availableGHSA-cpv4-ggrr-7j9v
—rasa-pro (PyPI)3.9.0 to before 3.9.163.9.16Patch availableGHSA-cpv4-ggrr-7j9v
—rasa-pro (PyPI)before 3.8.183.8.18Patch availableGHSA-cpv4-ggrr-7j9v
—rasa (PyPI)before 3.6.213.6.21Patch availableGHSA-cpv4-ggrr-7j9v
  • rasa-pro-security-advisories VendorRasaHQ Affected before 3.6.21 Fixed in 3.6.21 Patch available CNA
  • rasa-pro (PyPI) Vendor— Affected 3.10.0 to before 3.10.12 Fixed in 3.10.12 Patch available GHSA-cpv4-ggrr-7j9v
  • rasa-pro (PyPI) Vendor— Affected 3.9.0 to before 3.9.16 Fixed in 3.9.16 Patch available GHSA-cpv4-ggrr-7j9v
  • rasa-pro (PyPI) Vendor— Affected before 3.8.18 Fixed in 3.8.18 Patch available GHSA-cpv4-ggrr-7j9v
  • rasa (PyPI) Vendor— Affected before 3.6.21 Fixed in 3.6.21 Patch available GHSA-cpv4-ggrr-7j9v

Remediation

  • Fix · CNA rasa-pro-security-advisories (RasaHQ) Fixed in 3.6.21
  • Fix · GHSA-cpv4-ggrr-7j9v rasa-pro (PyPI) Fixed in 3.10.12 Advisory →
  • Fix · GHSA-cpv4-ggrr-7j9v rasa-pro (PyPI) Fixed in 3.9.16 Advisory →
  • Fix · GHSA-cpv4-ggrr-7j9v rasa-pro (PyPI) Fixed in 3.8.18 Advisory →
  • Fix · GHSA-cpv4-ggrr-7j9v rasa (PyPI) Fixed in 3.6.21 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-49375
  2. 2026-10-03 Alias added: GHSA-cpv4-ggrr-7j9v

References

Advisory 1

Other 3

  • TI-2025-23456 Rasa Pro Missing Authentication For Voice Connector APIs CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences