CVE-2024-4897: Remote Code Execution in parisneo/lollms-webui
parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llamacpppython-0.2.61+cpuavx2-cp311-cp311-manylinux231x8664. The vulnerability arises from the application's 'bindingzoo' feature, which allows attackers to upload and interact with a malicious model file hosted on hugging-face, leading to remote code execution. The issue is linked to a known vulnerability in llama-cpp-python, CVE-2024-34359, which has not been patched in lollms-webui as of commit b454f40a. The vulnerability is exploitable through the application's handling of model files in the 'bindingszoo' feature, specifically when processing gguf format model files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
parisneo/lollms-webuito a version that resolves this vulnerability.Patch CVE-2024-34359 - Upgrade
Upgrade
llama-cpp-pythonto a version that resolves this vulnerability.Fixed in llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4897?
CVE-2024-4897 is rated as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2024-4897?
To fix CVE-2024-4897, update the dependency on llama-cpp-python to a secure version that does not contain the vulnerability.
Which software is affected by CVE-2024-4897?
CVE-2024-4897 affects the lollms-webui software developed by parisneo and its dependency llama-cpp-python.
What type of vulnerability is CVE-2024-4897?
CVE-2024-4897 is classified as a remote code execution vulnerability.
Can CVE-2024-4897 be exploited remotely?
Yes, CVE-2024-4897 can be exploited remotely, allowing an attacker to execute arbitrary code on the affected system.