Homepage

lollms@11.0.0 vulnerabilities

A python library for AI personality definition

  • latest version

    11.0.0

  • first published

    1 years ago

  • latest version published

    11 days ago

  • licenses detected

  • View lollms package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the lollms package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Cross-site Scripting (XSS)

    lollms is a python library for AI personality definition

    Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the sanitize_svg function.

    How to fix Cross-site Scripting (XSS)?

    A fix was pushed into the master branch but not yet published.

    [0,)
    • H
    Improper Control of Generation of Code ('Code Injection')

    lollms is a python library for AI personality definition

    Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection') through the create_conda_env function. An attacker can execute arbitrary commands by manipulating the env_name and python_version parameters.

    How to fix Improper Control of Generation of Code ('Code Injection')?

    There is no fixed version for lollms.

    [0,)
    • M
    Path Traversal

    lollms is a python library for AI personality definition

    Affected versions of this package are vulnerable to Path Traversal in speaker wav and output file paths.. This vulnerability can be abused to write audio files compatible with XTTS to arbitrary locations on the system, and also enumerate such file paths on the system.

    How to fix Path Traversal?

    There is no fixed version for lollms.

    [0,)
    • H
    Path Traversal

    lollms is a python library for AI personality definition

    Affected versions of this package are vulnerable to Path Traversal due to the possibility of performing an unauthenticated root folder settings change. An attacker can read arbitrary files on the system.

    Note: This vulnerability can be abused to write audio files compatible with XTTS to arbitrary locations on the system, and also enumerate such file paths on the system.

    How to fix Path Traversal?

    There is no fixed version for lollms.

    [0,)
    Go back to all versions of this package