CVE-2024-5933: Cross-site Scripting (XSS) in parisneo/lollms-webui

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-06-27 · updated 2026-06-17
Weakness: CWE-79

Description

A Cross-site Scripting (XSS) vulnerability exists in the chat functionality of parisneo/lollms-webui in the latest version. This vulnerability allows an attacker to inject malicious scripts via chat messages, which are then executed in the context of the user's browser.

Affected products

ParisNeo lollms-webui: all versions

References

https://huntr.com/bounties/51a2e370-3b64-45cd-9afc-0e4856ab5517
https://huntr.com/bounties/51a2e370-3b64-45cd-9afc-0e4856ab5517

Get alerted when CVE-2024-5933 or the next vulnerability affects your stack