{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-05-02T22:33:09.426","vulnerabilities":[{"cve":{"id":"CVE-2024-10131","sourceIdentifier":"security@huntr.dev","published":"2024-10-19T04:15:05.300","lastModified":"2025-10-15T13:15:34.100","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. The function uses user-supplied input `req['llm_factory']` and `req['llm_name']` to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to potentially execute arbitrary code due to the lack of comprehensive input validation or sanitization. An attacker could provide a malicious value for 'llm_factory' that, when used as an index to these model dictionaries, results in the execution of arbitrary code."},{"lang":"es","value":"La función `add_llm` en `llm_app.py` en infiniflow/ragflow versión 0.11.0 contiene una vulnerabilidad de ejecución remota de código (RCE). La función utiliza la entrada proporcionada por el usuario `req['llm_factory']` y `req['llm_name']` para instanciar dinámicamente clases de varios diccionarios de modelos. Este enfoque permite a un atacante ejecutar código arbitrario debido a la falta de una validación o desinfección integral de la entrada. Un atacante podría proporcionar un valor malicioso para 'llm_factory' que, cuando se utiliza como índice para estos diccionarios de modelos, da como resultado la ejecución de código arbitrario."}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}],"cvssMetricV30":[{"source":"security@huntr.dev","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9}]},"weaknesses":[{"source":"security@huntr.dev","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:infiniflow:ragflow:0.11.0:*:*:*:*:*:*:*","matchCriteriaId":"B1CFDFA2-0908-48AA-B613-BC2B0FB248BE"}]}]}],"references":[{"url":"https://huntr.com/bounties/42ae0b27-e851-4b58-a991-f691a437fbaa","source":"security@huntr.dev","tags":["Exploit","Third Party Advisory"]}]}}]}