CVE-2024-6982
CVSS 3.0 Score 8.4 of 10 (high)
Details
Published Mar 20, 2025
CWE ID 94
Summary
CVE-2024-6982 is a remote code execution vulnerability affecting the Calculate function in version 9.8 of the parisneo/lollms package. The issue arises due to the use of Python's `eval()` function within a sandbox designed to restrict functions to the `math` module. An attacker can bypass this sandbox by loading the `os` module using the `_frozen_importlib.BuiltinImporter` class, which enables the execution of arbitrary commands on the server. This vulnerability has been addressed in the latest version, 9.10.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.