CVE-2024-3121: Remote Code Execution in create_conda_env function in parisneo/lollms
A remote code execution vulnerability exists in the createcondaenv function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the envname and pythonversion parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the 'whoami' command among potentially other harmful commands.
Other sources
A remote code execution vulnerability exists in the createcondaenv function of the parisneo/lollms repository. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the envname and pythonversion parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the 'whoami' command among potentially other harmful commands.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3121?
CVE-2024-3121 is classified as a high severity remote code execution vulnerability.
How do I fix CVE-2024-3121?
To fix CVE-2024-3121, upgrade the lollms package to version 5.9.0 or higher.
Which versions of lollms are affected by CVE-2024-3121?
CVE-2024-3121 affects specifically version 5.9.0 of the lollms package.
Can CVE-2024-3121 be exploited remotely?
Yes, CVE-2024-3121 can be exploited remotely due to its remote code execution nature.
What causes the vulnerability in CVE-2024-3121?
The vulnerability in CVE-2024-3121 is caused by using shell=True in the subprocess.Popen function, allowing command injection.