VULNERABILITY INTELLIGENCE

CVE-2024-1520

CVSS score9.8 CRITICAL
EPSS probability48.21%
CISA KEVNot currently listed
Published2024-04-10
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-supplied input in the 'discussion_id' parameter. Attackers can exploit this vulnerability by injecting malicious OS commands, leading to unauthorized command execution on the underlying operating system. This could result in unauthorized access, data leakage, or complete system compromise.

Weakness classification

  • security@huntr.dev: CWE-78

Primary references