THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Fathom (Privacy friendly web analytics)
Zendesk (Helpdesk and Chat)

Ok

Home | EN
Support
CVE
PUBLISHED

CVE-2024-3121

Remote Code Execution in create_conda_env function in parisneo/lollms

Assigner@huntr_ai
Reserved2024-03-31
Published2024-06-24
Updated2024-07-08

Description

A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the env_name and python_version parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the 'whoami' command among potentially other harmful commands.



MEDIUM: 6.8CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-94 Improper Control of Generation of Code

Product status

Any version
affected

References

https://huntr.com/bounties/db57c343-9b80-4c1c-9ab0-9eef92c9b27b

cve.org CVE-2024-3121

nvd.nist.gov CVE-2024-3121

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-3121
© Copyright 2024 THREATINT. Made in Cyprus with +