AVID-2026-R1556

Description

XSS and Open Redirect via SVG File Upload in parisneo/lollms-webui (CVE-2024-5125)

Details

parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files during the upload process. The XSS vulnerability allows attackers to embed malicious JavaScript code within SVG files, which is executed upon rendering, leading to potential credential theft and unauthorized data access. The Open Redirect vulnerability arises from insufficient URL validation within SVG files, enabling attackers to redirect users to malicious websites, thereby exposing them to phishing attacks, malware distribution, and reputation damage. These vulnerabilities are present in the application’s functionality to send files to the AI module.

Reason for inclusion in AVID: The CVE describes XSS and Open Redirect vulnerabilities in parisneo/lollms-webui, a web UI component used to interact with and deploy AI models. This is a software vulnerability within an AI software stack (deployment/serving interface) that could impact AI systems. The issue is relevant to AI supply chains as it affects components used to build/run AI workloads, with clear security implications. The report provides explicit vulnerability details, CVE metadata, and references.

References

• NVD entry
• https://huntr.com/bounties/e6ae8cfd-9f8b-41df-a0cc-1e7a47416995
• https://github.com/parisneo/lollms-webui/commit/9b0f6c4ad1b9a2cd3466dcefaa278df30feed67e

Affected or Relevant Artifacts

• Developer: parisneo
• Deployer: parisneo
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

CVSS

CWE

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2024-11-14
• Version: 0.3.3
• AVID Entry