CVE-2024-6982: Remote Code Execution in Calculate Function in parisneo/lollms
A remote code execution vulnerability exists in the Calculate function of parisneo/lollms version 9.8. The vulnerability arises from the use of Python's eval() function to evaluate mathematical expressions within a Python sandbox that disables builtins and only allows functions from the math module. This sandbox can be bypassed by loading the os module using the frozenimportlib.BuiltinImporter class, allowing an attacker to execute arbitrary commands on the server. The issue is fixed in version 9.10.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6982?
CVE-2024-6982 is rated as a high severity remote code execution vulnerability.
How do I fix CVE-2024-6982?
To fix CVE-2024-6982, upgrade to lollms version 11.0.0 or later.
What causes the CVE-2024-6982 vulnerability?
CVE-2024-6982 is caused by the insecure use of Python's eval() function in the Calculate function of lollms.
Which versions of lollms are affected by CVE-2024-6982?
CVE-2024-6982 affects lollms versions up to 9.10.
Is there a workaround for CVE-2024-6982?
There are no known workarounds for CVE-2024-6982; updating to the patched version is recommended.