# lollms (PyPI) vulnerabilities 24 known vulnerabilities (6 critical, 12 high, 5 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 11.0.0 (Feb 15, 2025): affected by 3 advisories - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 2,041 - Dependents: 0 - Releases: 266 since 1.1.3 (Jun 4, 2023) - Registry: https://pypi.org/project/lollms/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-1116: 1.1.3 to 2.1.0 (2.1.1 is outside it) - CVE-2026-1115: 1.1.3 to 2.1.60 (2.2.0 is outside it) - CVE-2026-1163: 1.1.3 to 11.0.0 (through the newest release) - CVE-2026-1114: 1.1.3 to 2.1.60 (2.2.0 is outside it) - CVE-2026-0558: 1.1.3 to 2.1.0 (2.1.1 is outside it) - CVE-2026-0560: 1.1.3 to 2.1.0 (2.1.1 is outside it) - CVE-2026-0562: 1.1.3 to 2.1.0 (2.1.1 is outside it) - CVE-2026-1117: 1.1.3 to 2.0.32 (2.1.0 is outside it) - CVE-2025-6386: 1.1.3 to 11.0.0 (through the newest release) - CVE-2024-6982: 1.1.3 to 9.5.1 (11.0.0 is outside it) - CVE-2024-6581: 1.1.3 to 11.0.0 (through the newest release) - CVE-2024-6985: 1.1.3 to 9.5.1 (11.0.0 is outside it) - CVE-2024-6971: 1.1.3 to 9.5.1 (11.0.0 is outside it) - CVE-2024-6281: 1.1.3 to 9.5.0 (9.5.1 is outside it) - CVE-2024-6139: 1.1.3 to 9.5.1 (11.0.0 is outside it) - CVE-2024-5824: 1.1.3 to 9.3.0 (9.5.0 is outside it) - CVE-2024-6085: 1.1.3 to 9.5.1 (11.0.0 is outside it) - CVE-2024-3121: 1.1.3 to 9.5.1 (11.0.0 is outside it) - CVE-2024-5443: 5.9.0 to 9.5.0 (9.5.1 is outside it) - CVE-2024-4315: 1.1.3 to 9.3.0 (9.5.0 is outside it) - CVE-2024-3429: 1.1.3 to 9.3.0 (9.5.0 is outside it) - CVE-2024-4881: 1.1.3 to 9.3.0 (9.5.0 is outside it) - CVE-2024-4330: no published release is affected - CVE-2024-4078: 1.1.3 to 9.3.0 (9.5.0 is outside it) ## Advisories (24) ### [CVE-2026-1116](https://cve.now/CVE-2026-1116): Cross-site Scripting (XSS) in parisneo/lollms - Severity: High 8.2 - Published: Apr 12, 2026 - Affected: fixed in 2.1.1. - Fixed in 2.1.1 (released Jun 29, 2023, 1018 days before disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2026-1115](https://cve.now/CVE-2026-1115): Stored XSS in parisneo/lollms - Severity: Critical 9.6 - Published: Apr 10, 2026 - Affected: fixed in 2.2.0. - Fixed in 2.2.0 (released Jul 29, 2023, 986 days before disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2026-1163](https://cve.now/CVE-2026-1163): Insufficient Session Expiration in parisneo/lollms - Severity: Medium 4.1 - Published: Apr 8, 2026 - Affected: through 11.0.0. - No fix released. The latest release, 11.0.0, is still affected. ### [CVE-2026-1114](https://cve.now/CVE-2026-1114): Improper Access Control via Weak JWT Token in parisneo/lollms - Severity: Critical 9.8 - Published: Apr 7, 2026 - Affected: fixed in 2.2.0; through 2.1.0. - Fixed in 2.2.0 (released Jul 29, 2023, 983 days before disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2026-0558](https://cve.now/CVE-2026-0558): Unauthenticated File Upload in parisneo/lollms - Severity: High 7.5 - Published: Mar 29, 2026 - Affected: fixed in 2.1.1. - Fixed in 2.1.1 (released Jun 29, 2023, 1004 days before disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2026-0560](https://cve.now/CVE-2026-0560): Server-Side Request Forgery (SSRF) in parisneo/lollms - Severity: High 7.5 - Published: Mar 29, 2026 - Affected: fixed in 2.1.1. - Fixed in 2.1.1 (released Jun 29, 2023, 1004 days before disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2026-0562](https://cve.now/CVE-2026-0562): Insecure Direct Object Reference (IDOR) in parisneo/lollms - Severity: High 8.3 - Published: Mar 29, 2026 - Affected: fixed in 2.1.1. - Fixed in 2.1.1 (released Jun 29, 2023, 1004 days before disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2026-1117](https://cve.now/CVE-2026-1117): Improper Access Control in parisneo/lollms - Severity: High 8.2 - Published: Feb 2, 2026 - Affected: fixed in 2.1.0. - Fixed in 2.1.0 (released Jun 29, 2023, 949 days before disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2025-6386](https://cve.now/CVE-2025-6386): Timing Attack Vulnerability in parisneo/lollms - Severity: High 7.5 - Published: Jul 7, 2025 - Affected: through 11.0.0. - No fix released. The latest release, 11.0.0, is still affected. ### [CVE-2024-6982](https://cve.now/CVE-2024-6982): Remote Code Execution in Calculate Function in parisneo/lollms - Severity: High 8.4 - Published: Mar 20, 2025 - Affected: fixed in 11.0.0. - Fixed in 11.0.0 (released Feb 15, 2025, 33 days before disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2024-6581](https://cve.now/CVE-2024-6581): Remote Code Execution due to Stored XSS in parisneo/lollms - Severity: Medium 6.5 - Published: Oct 29, 2024 - Affected: through 9.5.1; all versions. - No fix released. The latest release, 11.0.0, is still affected. ### [CVE-2024-6985](https://cve.now/CVE-2024-6985): Path Traversal in api open\_personality\_folder in parisneo/lollms-webui - Severity: Medium 4.4 - Published: Oct 11, 2024 - Affected: through 9.5.1; fixed in 5.9.0. - Fixed in 11.0.0 (released Feb 15, 2025, 127 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2024-6971](https://cve.now/CVE-2024-6971): Path Traversal in parisneo/lollms-webui - Severity: Low 3.4 - Published: Oct 11, 2024 - Affected: through 9.5.1. - Fixed in 11.0.0 (released Feb 15, 2025, 127 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2024-6281](https://cve.now/CVE-2024-6281): Path Traversal in parisneo/lollms - Severity: High 7.3 - Published: Jul 20, 2024 - Affected: fixed in 9.5.1. - Fixed in 9.5.1 (released Jun 23, 2024, 27 days before disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2024-6139](https://cve.now/CVE-2024-6139): Path Traversal in parisneo/lollms - Severity: High 7.3 - Published: Jun 27, 2024 - Affected: through 9.5.1. - Fixed in 11.0.0 (released Feb 15, 2025, 233 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2024-5824](https://cve.now/CVE-2024-5824): Path Traversal in parisneo/lollms - Severity: High 7.4 - Published: Jun 27, 2024 - Affected: fixed in 9.5.0. - Fixed in 9.5.0 (released Jun 10, 2024, 17 days before disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2024-6085](https://cve.now/CVE-2024-6085): Path Traversal in parisneo/lollms - Severity: High 8.6 - Published: Jun 27, 2024 - Affected: through 9.5.1. - Fixed in 11.0.0 (released Feb 15, 2025, 233 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2024-3121](https://cve.now/CVE-2024-3121): Remote Code Execution in create\_conda\_env function in parisneo/lollms - Severity: Medium 6.8 - Published: Jun 24, 2024 - Affected: through 9.5.1. - Fixed in 11.0.0 (released Feb 15, 2025, 236 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2024-5443](https://cve.now/CVE-2024-5443): Remote Code Execution via Path Traversal in parisneo/lollms - Severity: Critical 9.8 - Published: Jun 22, 2024 - Affected: from 5.9.0, fixed in 9.5.1. - Fixed in 9.5.1 (released Jun 23, 2024, 1 day after disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2024-4315](https://cve.now/CVE-2024-4315): LFI Vulnerability due to Lack of Path Sanitization in parisneo/lollms - Severity: Critical 9.1 - Published: Jun 12, 2024 - Affected: fixed in 9.5.0. - Fixed in 9.5.0 (released Jun 10, 2024, 2 days before disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2024-3429](https://cve.now/CVE-2024-3429): Path Traversal in parisneo/lollms - Severity: Critical 9.8 - Published: Jun 6, 2024 - Affected: fixed in 9.5.0. - Fixed in 9.5.0 (released Jun 10, 2024, 4 days after disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2024-4881](https://cve.now/CVE-2024-4881): Path Traversal in parisneo/lollms - Severity: High 7.5 - Published: Jun 6, 2024 - Affected: fixed in 9.5.0; fixed in 5.9.0. - Fixed in 9.5.0 (released Jun 10, 2024, 4 days after disclosure). - The latest release, 11.0.0, is not affected. ### [CVE-2024-4330](https://cve.now/CVE-2024-4330): Path Traversal in parisneo/lollms-webui - Severity: Medium 4.0 - Published: May 30, 2024 - Affected: versions 9.6. - Fixed in 11.0.0 (released Feb 15, 2025, 261 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 11.0.0, is not affected. ### [CVE-2024-4078](https://cve.now/CVE-2024-4078): Arbitrary Code Execution in parisneo/lollms - Severity: Critical 9.8 - Published: May 16, 2024 - Affected: fixed in 9.5.0. - Fixed in 9.5.0 (released Jun 10, 2024, 25 days after disclosure). - The latest release, 11.0.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/lollms Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.