PT-2025-6767 · Unknown · Parisneo/Lollms

Published 2025-02-14 · Updated 2025-03-20 · CVE-2024-6982

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions parisneo/lollms version 9.8

Description A remote code execution issue exists in the Calculate function due to the use of Python's eval() function to evaluate mathematical expressions within a Python sandbox. This sandbox, which disables builtins and only allows functions from the math module, can be bypassed by loading the os module using the frozen importlib.BuiltinImporter class. This allows an attacker to execute arbitrary commands on the server.

Recommendations For parisneo/lollms version 9.8, update to version 9.10 to resolve the issue. As a temporary workaround, consider disabling the Calculate function until a patch is available. Restrict access to the os module to minimize the risk of exploitation. Avoid using the eval() function in the Calculate function until the issue is resolved.

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-6982

GHSA-JCCX-M9V4-9HWH

Affected Products

Parisneo/Lollms

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-6982 · Security Note
• https://osv.dev/vulnerability/GHSA-jccx-m9v4-9hwh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-6982 · Vendor Advisory
• https://github.com/ParisNeo/lollms · Note
• https://github.com/parisneo/lollms/commit/30e7eaba2ccfb751a81e7cb29fdef2ae8ffa6832 · Note
• https://twitter.com/CVEnew/status/1902671104285552778 · Twitter Post
• https://twitter.com/ksg93rd/status/1890412652389675023 · Twitter Post
• https://huntr.com/bounties/4f8e73ac-aaaf-4d5c-a6dd-58215b5a7fea · Note
• https://t.me/cybersecuritytechnologies/11812 · Telegram Post