Security advisories

critical2026-04-10

CVE-2026-1115-parisneo/lollms vulnerable to stored XSS in the social feature

GHSA-8wrq-fv5f-pfp2

medium2026-04-08

CVE-2026-1163-parisneo/lollms has an insufficient session expiration vulnerability

GHSA-8jg2-726g-xh43

critical2026-04-07

CVE-2026-1114-LoLLMs is vulnerable to Improper Access Control through weak secret key

GHSA-9296-v3fr-j92j

high2026-02-02

CVE-2026-1117-Lollms has an Improper Access Control vulnerability

GHSA-82fw-ch24-j34w

high2025-07-07

CVE-2025-6386-Lord of Large Language Models vulnerable to Observable Discrepancy attack via authenticate_user function

GHSA-j5pr-vrjj-9v4h

high2025-03-20

CVE-2024-6982-LoLLMS Code Injection vulnerability

GHSA-jccx-m9v4-9hwh

medium2024-10-29

CVE-2024-6581-Lollms vulnerable to Cross-site Scripting

GHSA-cm59-8rmv-f2cj

medium2024-10-11

CVE-2024-6985-Lord of Large Language Models (LoLLMs) path traversal vulnerability in the api open_personality_folder endpoint

GHSA-6h64-g7cj-hj56

low2024-10-11

CVE-2024-6971-Lord of Large Language Models (LoLLMs) Server path traversal vulnerability in lollms_file_system.py

GHSA-7pgr-32fx-c6x9

high2024-07-20

CVE-2024-6281-LoLLMS vulnerable to Expected Behavior Violation

GHSA-8mrm-r7h3-c3hj

high2024-06-27

CVE-2024-6139-lollms vulnerable to dot-dot-slash path traversal in XTTS server

GHSA-w9qf-83jg-2x6c

high2024-06-27

CVE-2024-5824-lollms path traversal vulnerability allows overriding of config.yaml file, leading to RCE

GHSA-m45c-v46h-c788

high2024-06-27

CVE-2024-6085-lollms vulnerable to path traversal due to unauthenticated root folder settings change

GHSA-9chm-m6x2-6fvc

medium2024-06-24

CVE-2024-3121-Remote Code Execution in create_conda_env function in lollms

GHSA-79h8-gxhq-q3jg

critical2024-06-22

CVE-2024-5443-Remote Code Execution via path traversal bypass in lollms

GHSA-mvrm-fh8q-6wr2

critical2024-06-12

CVE-2024-4315-parisneo/lollms Local File Inclusion (LFI) attack

GHSA-vqwr-q6cc-c242

high2024-06-06

CVE-2024-4881-LoLLMS Path Traversal vulnerability

GHSA-p8h7-c8gw-6x8c

high2024-06-06

CVE-2024-3429-LoLLMS Path Traversal vulnerability

GHSA-3x47-w4rx-6pm7

medium2024-06-02

CVE-2024-4330-path traversal vulnerability was identified in the parisneo/lollms-webui

GHSA-9p73-x86v-jw57

high2024-05-16

CVE-2024-4078-LoLLMS Command Injection vulnerability

GHSA-pwc9-q4hj-pg8g