Lollms vulnerabilities
We track 43 vulnerabilities in Lollms products across 3 products. 43 are rated high or critical, and none are known to be exploited. The most recent was published on April 10, 2026.
Latest Lollms vulnerabilities
- 9.8 Critical severity
parisneo/lollms-webui: Improper Neutralization of Special Elements used in an OS Command
An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-supplied input in the 'discussion_id' parameter. Attackers can exploit this vulnerability by injecting
- 9.8 Critical severity
parisneo/lollms-webui: Improper Limitation of a Pathname to a Restricted Directory
The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allows an unauthenticated attacker to read, write, and in certain configurations execute arbitrary files o
- 8.8 High severity
parisneo/lollms-webui: Cross-Site Request Forgery
A Cross-Site Request Forgery (CSRF) vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system. The vulnerability stems from the `/execute_code` API endpoint, which does not properly validate reque