Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

lollms

24 known vulnerabilities (6 critical, 12 high, 5 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
11.0.0 (Feb 15, 2025): affected by 3 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
24 · 6 critical, 12 high, 5 medium, 1 low
Weekly downloads
2,041
Dependents
0
Releases
266 since 1.1.3 (Jun 4, 2023)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

Show all 24 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 24

  • Cross-site Scripting (XSS) in parisneo/lollms

    Affected: fixed in 2.1.1.

    Fixed in 2.1.1 (released Jun 29, 2023, 1018 days before disclosure).

    The latest release, 11.0.0, is not affected.

  • CVE-2026-1115Critical 9.6

    Stored XSS in parisneo/lollms

    Affected: fixed in 2.2.0.

    Fixed in 2.2.0 (released Jul 29, 2023, 986 days before disclosure).

    The latest release, 11.0.0, is not affected.

  • CVE-2026-1163Medium 4.1

    Insufficient Session Expiration in parisneo/lollms

    Affected: through 11.0.0.

    No fix released. The latest release, 11.0.0, is still affected.

  • CVE-2026-1114Critical 9.8

    Improper Access Control via Weak JWT Token in parisneo/lollms

    Affected: fixed in 2.2.0; through 2.1.0.

    Fixed in 2.2.0 (released Jul 29, 2023, 983 days before disclosure).

    The latest release, 11.0.0, is not affected.

  • Unauthenticated File Upload in parisneo/lollms

    Affected: fixed in 2.1.1.

    Fixed in 2.1.1 (released Jun 29, 2023, 1004 days before disclosure).

    The latest release, 11.0.0, is not affected.

  • Server-Side Request Forgery (SSRF) in parisneo/lollms

    Affected: fixed in 2.1.1.

    Fixed in 2.1.1 (released Jun 29, 2023, 1004 days before disclosure).

    The latest release, 11.0.0, is not affected.

  • Insecure Direct Object Reference (IDOR) in parisneo/lollms

    Affected: fixed in 2.1.1.

    Fixed in 2.1.1 (released Jun 29, 2023, 1004 days before disclosure).

    The latest release, 11.0.0, is not affected.

  • Improper Access Control in parisneo/lollms

    Affected: fixed in 2.1.0.

    Fixed in 2.1.0 (released Jun 29, 2023, 949 days before disclosure).

    The latest release, 11.0.0, is not affected.

  • Timing Attack Vulnerability in parisneo/lollms

    Affected: through 11.0.0.

    No fix released. The latest release, 11.0.0, is still affected.

  • Remote Code Execution in Calculate Function in parisneo/lollms

    Affected: fixed in 11.0.0.

    Fixed in 11.0.0 (released Feb 15, 2025, 33 days before disclosure).

    The latest release, 11.0.0, is not affected.

  • CVE-2024-6581Medium 6.5

    Remote Code Execution due to Stored XSS in parisneo/lollms

    Affected: through 9.5.1; all versions.

    No fix released. The latest release, 11.0.0, is still affected.

  • CVE-2024-6985Medium 4.4

    Path Traversal in api open_personality_folder in parisneo/lollms-webui

    Affected: through 9.5.1; fixed in 5.9.0.

    Fixed in 11.0.0 (released Feb 15, 2025, 127 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • Path Traversal in parisneo/lollms-webui

    Affected: through 9.5.1.

    Fixed in 11.0.0 (released Feb 15, 2025, 127 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • Path Traversal in parisneo/lollms

    Affected: fixed in 9.5.1.

    Fixed in 9.5.1 (released Jun 23, 2024, 27 days before disclosure).

    The latest release, 11.0.0, is not affected.

  • Path Traversal in parisneo/lollms

    Affected: through 9.5.1.

    Fixed in 11.0.0 (released Feb 15, 2025, 233 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

Show all 24 advisoriesShow fewer advisories

  • Path Traversal in parisneo/lollms

    Affected: fixed in 9.5.0.

    Fixed in 9.5.0 (released Jun 10, 2024, 17 days before disclosure).

    The latest release, 11.0.0, is not affected.

  • Path Traversal in parisneo/lollms

    Affected: through 9.5.1.

    Fixed in 11.0.0 (released Feb 15, 2025, 233 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • CVE-2024-3121Medium 6.8

    Remote Code Execution in create_conda_env function in parisneo/lollms

    Affected: through 9.5.1.

    Fixed in 11.0.0 (released Feb 15, 2025, 236 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • CVE-2024-5443Critical 9.8

    Remote Code Execution via Path Traversal in parisneo/lollms

    Affected: from 5.9.0, fixed in 9.5.1.

    Fixed in 9.5.1 (released Jun 23, 2024, 1 day after disclosure).

    The latest release, 11.0.0, is not affected.

  • CVE-2024-4315Critical 9.1

    LFI Vulnerability due to Lack of Path Sanitization in parisneo/lollms

    Affected: fixed in 9.5.0.

    Fixed in 9.5.0 (released Jun 10, 2024, 2 days before disclosure).

    The latest release, 11.0.0, is not affected.

  • CVE-2024-3429Critical 9.8

    Path Traversal in parisneo/lollms

    Affected: fixed in 9.5.0.

    Fixed in 9.5.0 (released Jun 10, 2024, 4 days after disclosure).

    The latest release, 11.0.0, is not affected.

  • Path Traversal in parisneo/lollms

    Affected: fixed in 9.5.0; fixed in 5.9.0.

    Fixed in 9.5.0 (released Jun 10, 2024, 4 days after disclosure).

    The latest release, 11.0.0, is not affected.

  • CVE-2024-4330Medium 4.0

    Path Traversal in parisneo/lollms-webui

    Affected: versions 9.6.

    Fixed in 11.0.0 (released Feb 15, 2025, 261 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 11.0.0, is not affected.

  • CVE-2024-4078Critical 9.8

    Arbitrary Code Execution in parisneo/lollms

    Affected: fixed in 9.5.0.

    Fixed in 9.5.0 (released Jun 10, 2024, 25 days after disclosure).

    The latest release, 11.0.0, is not affected.