Command Injection Vulnerability in lollms-webui Could Lead to Remote Code Execution

CVE-2024-3126

Summary

A command injection vulnerability in the 'run_xtts_api_server' function of parisneo’s lollms-webui application poses a significant security risk. This issue originates from the failure to properly neutralize special elements in an operating system command. By leveraging the 'subprocess.Popen' method in the 'lollms_xtts.py' script, the vulnerable function constructs a command using an unfiltered Python f-string that incorporates user-supplied input from the 'xtts_base_url' parameter. Without adequate input sanitization, attackers may exploit this flaw to execute arbitrary commands on the host system. This susceptibility affects all versions of the lollms-webui application up to and including version 9.5, potentially leading to serious security breaches and the remote execution of malicious code.

References