What’s Vulnerable › Vulnerabilities

CVE-2024-1569: Uncontrolled Resource Consumption in parisneo/lollms-webui

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-04-16 · updated 2026-06-17
• Weakness: CWE-400

Description

parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attackers can exploit the `/open_code_in_vs_code` and similar endpoints without authentication by sending repeated HTTP POST requests, leading to the opening of Visual Studio Code or the default folder opener (e.g., File Explorer, xdg-open) multiple times. This can render the host machine unusable by exhausting system resources. The vulnerability is present in the latest version of the software.

Affected products

• parisneo/lollms-webui: 9.1

References

• https://github.com/parisneo/lollms-webui/commit/354cf766835396b7fc0d5105ed3b77572a653149
• https://huntr.com/bounties/369d1694-47e4-49bc-bb35-931ce4a5148e
• https://github.com/parisneo/lollms-webui/commit/354cf766835396b7fc0d5105ed3b77572a653149
• https://huntr.com/bounties/369d1694-47e4-49bc-bb35-931ce4a5148e

Get alerted when CVE-2024-1569 or the next vulnerability affects your stack