CVE-2024-4897

parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64. The vulnerability arises from the application's 'binding_zoo' feature, which allows attackers to upload and interact with a malicious model file hosted on hugging-face, leading to remote code execution. The issue is linked to a known vulnerability in llama-cpp-python, CVE-2024-34359, which has not been patched in lollms-webui as of commit b454f40a. The vulnerability is exploitable through the application's handling of model files in the 'bindings_zoo' feature, specifically when processing gguf format model files.

• CWE-76

• https://huntr.com/bounties/ecf386df-4b6a-40b2-9000-db0974355accExploit, Issue Tracking, Patch, Third Party Advisory
• https://huntr.com/bounties/ecf386df-4b6a-40b2-9000-db0974355accExploit, Issue Tracking, Patch, Third Party Advisory

Published

Jul 2, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-4896The WPB Elementor Addons plugin for WordPress is vulnerable …5.4
• CVE-2024-48962Improper Control of Generation of Code ('Code Injection'), C…8.8
• CVE-2024-48963The package Snyk CLI before 1.1294.0 is vulnerable to Code I…9.8
• CVE-2024-48964The package Snyk CLI before 1.1294.0 is vulnerable to Code I…8.8
• CVE-2024-48966The software tools used by service personnel to test & calib…10
• CVE-2024-48967The ventilator and the Service PC lack sufficient audit logg…10
• CVE-2024-48970The ventilator's microcontroller lacks memory protection. An…9.3
• CVE-2024-48971The Clinician Password and Serial Number Clinician Password …9.3
• CVE-2024-48973The debug port on the ventilator's serial interface is enabl…9.3
• CVE-2024-48974The ventilator does not perform proper file integrity checks…9.3
• CVE-2024-4898The InstaWP Connect – 1-click WP Staging & Migration plugin …9.8
• CVE-2024-48981An issue was discovered in MBed OS 6.16.0. During processing…7.5