CVE-2024-6982

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-6982
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6982.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-6982
Aliases
Published
2025-03-20T10:15:34.740Z
Modified
2026-04-10T05:19:30.256214Z
Severity
  • 8.4 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A remote code execution vulnerability exists in the Calculate function of parisneo/lollms version 9.8. The vulnerability arises from the use of Python's eval() function to evaluate mathematical expressions within a Python sandbox that disables __builtins__ and only allows functions from the math module. This sandbox can be bypassed by loading the os module using the _frozen_importlib.BuiltinImporter class, allowing an attacker to execute arbitrary commands on the server. The issue is fixed in version 9.10.

References

Affected packages

Git /

Affected ranges

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6982.json"