CVE-2024-3126

Name: CVE-2024-3126
Creator: NVD / NIST
Published: 2024-05-16T09:15:13.84+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.32%

Last modified Jun 17, 2026

CVE-2024-3126 is a vulnerability of currently unknown severity. A command injection vulnerability exists in the 'run_xtts_api_server' function of the parisneo/lollms-webui application, specifically within the 'lollms_xtts.py' script. The vulnerability arises due to the improper neutralization of special elements used in an OS command. EPSS estimates a 1.32% chance of exploitation in the next 30 days.

Description

A command injection vulnerability exists in the 'run_xtts_api_server' function of the parisneo/lollms-webui application, specifically within the 'lollms_xtts.py' script. The vulnerability arises due to the improper neutralization of special elements used in an OS command. The affected function utilizes 'subprocess.Popen' to execute a command constructed with a Python f-string, without adequately sanitizing the 'xtts_base_url' input. This flaw allows attackers to execute arbitrary commands remotely by manipulating the 'xtts_base_url' parameter. The vulnerability affects versions up to and including the latest version before 9.5. Successful exploitation could lead to arbitrary remote code execution (RCE) on the system where the application is deployed.

Metrics

EPSS Probability

1.32%

67.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-78

Affected Software

Vendor	Product	Versions
Lollms	Lollms Web Ui	< 9.5

References

https://github.com/parisneo/lollms-webui/commit/41dbb1b3f2e78ea276e5269544e50514252c0c25Patch
https://huntr.com/bounties/0e2bec70-826e-4c24-8015-31921e23fd12Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/parisneo/lollms-webui/commit/41dbb1b3f2e78ea276e5269544e50514252c0c25Patch
https://huntr.com/bounties/0e2bec70-826e-4c24-8015-31921e23fd12Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: May 16, 2024
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2024-3126?

How severe is CVE-2024-3126?

Severity scoring for CVE-2024-3126 is pending analysis. The EPSS model estimates a 1.32% probability of exploitation in the next 30 days.

How do I fix CVE-2024-3126?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-3126?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST