CVE-2024-3126

A command injection vulnerability exists in the 'run_xtts_api_server' function of the parisneo/lollms-webui application, specifically within the 'lollms_xtts.py' script. The vulnerability arises due to the improper neutralization of special elements used in an OS command. The affected function utilizes 'subprocess.Popen' to execute a command constructed with a Python f-string, without adequately sanitizing the 'xtts_base_url' input. This flaw allows attackers to execute arbitrary commands remotely by manipulating the 'xtts_base_url' parameter. The vulnerability affects versions up to and including the latest version before 9.5. Successful exploitation could lead to arbitrary remote code execution (RCE) on the system where the application is deployed.

• CWE-78

• https://github.com/parisneo/lollms-webui/commit/41dbb1b3f2e78ea276e5269544e50514252c0c25Patch
• https://huntr.com/bounties/0e2bec70-826e-4c24-8015-31921e23fd12Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/parisneo/lollms-webui/commit/41dbb1b3f2e78ea276e5269544e50514252c0c25Patch
• https://huntr.com/bounties/0e2bec70-826e-4c24-8015-31921e23fd12Exploit, Issue Tracking, Patch, Third Party Advisory

Published

May 16, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-31254Insertion of Sensitive Information into Log File vulnerabili…7.5
• CVE-2024-31255Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2024-31256Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2024-31257Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2024-31258Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2024-31259Insertion of Sensitive Information into Log File vulnerabili…7.5
• CVE-2024-31260Improper Neutralization of Special Elements used in an SQL C…7.2
• CVE-2024-31261Missing Authorization vulnerability in Aakash Chakravarthy A…8.8
• CVE-2024-31262Cross-Site Request Forgery (CSRF) vulnerability in Jcodex Wo…5.4
• CVE-2024-31263Cross-Site Request Forgery (CSRF) vulnerability in aerin Loa…5.4
• CVE-2024-31264Unauthenticated Cross Site Request Forgery (CSRF) in Post Vi…4.3
• CVE-2024-31265Cross-Site Request Forgery (CSRF) vulnerability in SumoMe Su…3.7