{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-30T17:57:15.924","vulnerabilities":[{"cve":{"id":"CVE-2024-4897","sourceIdentifier":"security@huntr.dev","published":"2024-07-02T15:15:11.853","lastModified":"2026-06-17T08:03:07.717","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64. The vulnerability arises from the application's 'binding_zoo' feature, which allows attackers to upload and interact with a malicious model file hosted on hugging-face, leading to remote code execution. The issue is linked to a known vulnerability in llama-cpp-python, CVE-2024-34359, which has not been patched in lollms-webui as of commit b454f40a. The vulnerability is exploitable through the application's handling of model files in the 'bindings_zoo' feature, specifically when processing gguf format model files."},{"lang":"es","value":"parisneo/lollms-webui, en su última versión, es vulnerable a la ejecución remota de código debido a una dependencia insegura de la versión llama-cpp-python llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64. La vulnerabilidad surge de la función 'binding_zoo' de la aplicación, que permite a los atacantes cargar e interactuar con un archivo de modelo malicioso alojado en hugging-face, lo que lleva a la ejecución remota de código. El problema está relacionado con una vulnerabilidad conocida en llama-cpp-python, CVE-2024-34359, que no ha sido parcheada en lollms-webui a partir de el commit b454f40a. La vulnerabilidad se puede explotar mediante el manejo de archivos de modelo por parte de la aplicación en la función 'bindings_zoo', específicamente cuando se procesan archivos de modelo en formato gguf."}],"affected":[{"source":"security@huntr.dev","affectedData":[{"vendor":"parisneo","product":"parisneo/lollms-webui","versions":[{"version":"unspecified","lessThanOrEqual":"latest","versionType":"custom","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"parisneo","product":"lollms-webui","defaultStatus":"unknown","cpes":["cpe:2.3:a:parisneo:lollms-webui:9.5:*:*:*:*:*:*:*"],"versions":[{"version":"9.5","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"security@huntr.dev","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.5,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-07-03T19:23:16.700092Z","id":"CVE-2024-4897","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@huntr.dev","type":"Secondary","description":[{"lang":"en","value":"CWE-76"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lollms:lollms_web_ui:*:*:*:*:*:*:*:*","versionEndExcluding":"9.8","matchCriteriaId":"B8698D4D-FA1A-40D5-9DD2-0804D296907C"}]}]}],"references":[{"url":"https://huntr.com/bounties/ecf386df-4b6a-40b2-9000-db0974355acc","source":"security@huntr.dev","tags":["Exploit","Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://huntr.com/bounties/ecf386df-4b6a-40b2-9000-db0974355acc","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Issue Tracking","Patch","Third Party Advisory"]}]}}]}