CVE-2024-6986: Cross-site Scripting (XSS) in parisneo/lollms-webui

Published Mar 20, 2025

Updated

A Cross-site Scripting (XSS) vulnerability exists in the Settings page of parisneo/lollms-webui version 9.8. The vulnerability is due to the improper use of the 'v-html' directive, which inserts the content of the 'fulltemplate' variable directly as HTML. This allows an attacker to execute malicious JavaScript code by injecting a payload into the 'System Template' input field under main configurations.

Affected Software

2 affected components

parisneo lollms-webui

lollms Lollms Web Ui=9.8

Event History

Mar 20, 2025

CVE Published

via MITRE·10:10 AM

Data Sourced

via MITRE·10:10 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:15 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2024-6986?

CVE-2024-6986 has a severity rating that indicates a significant risk, particularly due to its potential for Cross-site Scripting (XSS) attacks.

How do I fix CVE-2024-6986?

To fix CVE-2024-6986, you should sanitize input and avoid using the 'v-html' directive for user-provided content in the Settings page.

Who is affected by CVE-2024-6986?

CVE-2024-6986 affects users of the parisneo/lollms-webui version 9.8 software.

What type of vulnerability is CVE-2024-6986?

CVE-2024-6986 is classified as a Cross-site Scripting (XSS) vulnerability.

What can an attacker do with CVE-2024-6986?

An attacker can exploit CVE-2024-6986 to inject malicious scripts into the user's browser, potentially compromising sensitive information.