CVE-2024-4897

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-4897
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-4897.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-4897
Published
2024-07-02T15:15:11.853Z
Modified
2026-04-10T05:17:48.941169Z
Severity
  • 8.4 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llamacpppython-0.2.61+cpuavx2-cp311-cp311-manylinux231x8664. The vulnerability arises from the application's 'bindingzoo' feature, which allows attackers to upload and interact with a malicious model file hosted on hugging-face, leading to remote code execution. The issue is linked to a known vulnerability in llama-cpp-python, CVE-2024-34359, which has not been patched in lollms-webui as of commit b454f40a. The vulnerability is exploitable through the application's handling of model files in the 'bindingszoo' feature, specifically when processing gguf format model files.

References

Affected packages

Git / github.com/parisneo/lollms-webui

Affected ranges

Type
GIT
Repo
https://github.com/parisneo/lollms-webui
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8a8e3a1c386321f641a014bf8f7029512ccad411
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "9.8"
        }
    ]
}

Affected versions

v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.0.9
v3.*
v3.0
v3.5
v4.*
v4.0
v5.*
v5.0
v6.*
v6.0
v6.5
v6.5.0
v6.5rc2
v6.7
v7.*
v7.0
v8.*
v8.5
v9.*
v9.0
v9.1
v9.2
v9.3
v9.4
v9.5
v9.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-4897.json"