Cross-site Scripting Vulnerability in lollms-webui by parisneo

CVE-2024-6986

What is CVE-2024-6986?

A Cross-site Scripting (XSS) vulnerability in the Settings page of lollms-webui version 9.8 allows attackers to inject and execute malicious JavaScript code. This issue originates from the improper handling of the 'v-html' directive, which directly incorporates user input from the 'System Template' field into the HTML content. By exploiting this vulnerability, attackers can manipulate and execute harmful scripts, posing significant security risks to users of the application.

References