CVE-2024-3121
Remote Code Execution in create_conda_env function in parisneo/lollms
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Remote Code Execution in create_conda_env function in parisneo/lollms
| Assigner | @huntr_ai |
| Reserved | 2024-03-31 |
| Published | 2024-06-24 |
| Updated | 2024-08-01 |
A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the env_name and python_version parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the 'whoami' command among potentially other harmful commands.
| CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CWE-94 Improper Control of Generation of Code
https://huntr.com/bounties/db57c343-9b80-4c1c-9ab0-9eef92c9b27b
