https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 10 Oct 2026 11:18:02 +0000 https://vulnerability.circl.lu/vuln/cve-2024-3121 <p><strong>Affected:</strong> parisneo/lollms, parisneo lollms</p> <p>A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the env_name and python_version parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the &#39;whoami&#39; command among potentially other harmful commands.</p> <p><strong>Affected:</strong> parisneo/lollms, parisneo lollms</p> <p>A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the env_name and python_version parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the &#39;whoami&#39; command among potentially other harmful commands.</p> https://vulnerability.circl.lu/vuln/cve-2024-3121 https://vulnerability.circl.lu/vuln/ghsa-79h8-gxhq-q3jg <p><strong>Affected:</strong> PyPI: lollms</p> <p>A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the env_name and python_version parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the &#39;whoami&#39; command among potentially other harmful commands.</p> <p><strong>Affected:</strong> PyPI: lollms</p> <p>A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the env_name and python_version parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the &#39;whoami&#39; command among potentially other harmful commands.</p> https://vulnerability.circl.lu/vuln/ghsa-79h8-gxhq-q3jg