Skip to content
OpenAdvisories
Medium · 5.3 CVE-2024-1569 EUVD-2024-17313GHSA-g2mr-jcjh-hmc7

Uncontrolled Resource Consumption in parisneo/lollms-webui

Published Apr 16, 2024 · Updated Aug 1, 2024 · Assigned by @huntr_ai

Description

parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attackers can exploit the `/open_code_in_vs_code` and similar endpoints without authentication by sending repeated HTTP POST requests, leading to the opening of Visual Studio Code or the default folder opener (e.g., File Explorer, xdg-open) multiple times. This can render the host machine unusable by exhausting system resources. The vulnerability is present in the latest version of the software.

Affected products

VendorProductAffectedFixed
parisneo parisneo/lollms-webui unspecified – < 9.2 9.2

References