What’s Vulnerable › Vulnerabilities

CVE-2024-6673: CSRF Vulnerability in parisneo/lollms-webui

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-10-29 · updated 2026-06-17
• Weakness: CWE-352

Description

A Cross-Site Request Forgery (CSRF) vulnerability exists in the `install_comfyui` endpoint of the `lollms_comfyui.py` file in the parisneo/lollms-webui repository, versions v9.9 to the latest. The endpoint uses the GET method without requiring a client ID, allowing an attacker to trick a victim into installing ComfyUI. If the victim's device does not have sufficient capacity, this can result in a crash.

Affected products

• ParisNeo lollms-webui: before 10 — fixed in 10

How to fix

Upgrade to a fixed version: ParisNeo lollms-webui 10. Check the vendor advisory for mitigations.

References

• https://github.com/parisneo/lollms-webui/commit/c1bb1ad19752aa7541675b398495eaf98fd589f1
• https://huntr.com/bounties/a38f9a7d-b357-427d-adac-f9654d8c0e3c

Get alerted when CVE-2024-6673 or the next vulnerability affects your stack