CVE-2024-6971: Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py
A path traversal vulnerability exists in the ParisNeo/lollms repository, specifically in the lollms_file_system.py
file. The functions add_rag_database
, toggle_mount_rag_database
, and vectorize_folder
do not implement security measures such as sanitize_path_from_endpoint
or sanitize_path
. This allows an attacker to perform vectorize operations on .sqlite
files in any directory on the victim’s computer, potentially installing multiple packages and causing a crash.
References
Detect and mitigate CVE-2024-6971 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →