Remote Code Execution Vulnerability in lollms by Parisneo

CVE-2024-6982

Summary

A remote code execution vulnerability exists in the Calculate function of lollms (version 9.8) due to unsafe usage of Python's eval() function. This security flaw arises within a sandbox designed to restrict built-in functions, yet an attacker can bypass these restrictions by loading the os module with the _frozen_importlib.BuiltinImporter class. This weakness allows for the execution of arbitrary commands on the server, potentially leading to severe security breaches. The vulnerability has been addressed in version 9.10.

References