CVE-2024-6982

Summary

A remote code execution vulnerability exists in the Calculate function of parisneo/lollms version 9.8. The vulnerability arises from the use of Python's eval() function to evaluate mathematical expressions within a Python sandbox that disables __builtins__ and only allows functions from the math module. This sandbox can be bypassed by loading the os module using the _frozen_importlib.BuiltinImporter class, allowing an attacker to execute arbitrary commands on the server. The issue is fixed in version 9.10.

Affected Software

VendorProductVersion RangeStatus
parisneoparisneo/lollmsunspecified < 9.10affected

Weaknesses

  • CWE-94: CWE-94 Improper Control of Generation of Code

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: no
    • Technical Impact: total

References