« Volver al listado

CVE-2026-1117

Estado: AplazadaAlta (8.2)—

A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The `add_events` function registers event handlers such as `generate_text`, `cancel_generation`, `generate_msg`, and `generate_msg_from` without implementing authentication or authorization checks. This allows unauthenticated clients to execute resource-intensive or state-altering operations, leading to potential denial of service, state corruption, and race conditions.

Leer descripción completaMostrar menos

Additionally, the use of global flags (`lollmsElfServer.busy`, `lollmsElfServer.cancel_gen`) for state management in a multi-client environment introduces further vulnerabilities, enabling one client's actions to affect the server's state and other clients' operations. The lack of proper access control and reliance on insecure global state management significantly impacts the availability and integrity of the service.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/PR:N/UI:N indica explotación remota sin privilegios (T1190). Los impactos incluyen DoS por operaciones intensivas de recursos (T1499.004) e integridad por corrupción de estado global y race conditions (T1565.001).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data StorageNetwork Segmentation

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Parisneo — LollmsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-1117",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-1117",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-02T17:49:35.417679Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security@huntr.dev",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@huntr.dev",
      "affectedData": [
        {
          "vendor": "parisneo",
          "product": "parisneo/lollms",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "2.0.0",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-02T10:16:06.500",
  "references": [
    {
      "url": "https://github.com/parisneo/lollms/commit/36a5b513dfefe9c2913bf9b618457b4fea603e3b",
      "source": "security@huntr.dev"
    },
    {
      "url": "https://huntr.com/bounties/d2846a7f-0140-4105-b1bb-5ef64ec8b829",
      "source": "security@huntr.dev"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@huntr.dev",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The `add_events` function registers event handlers such as `generate_text`, `cancel_generation`, `generate_msg`, and `generate_msg_from` without implementing authentication or authorization checks. This allows unauthenticated clients to execute resource-intensive or state-altering operations, leading to potential denial of service, state corruption, and race conditions. Additionally, the use of global flags (`lollmsElfServer.busy`, `lollmsElfServer.cancel_gen`) for state management in a multi-client environment introduces further vulnerabilities, enabling one client's actions to affect the server's state and other clients' operations. The lack of proper access control and reliance on insecure global state management significantly impacts the availability and integrity of the service."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en el componente 'lollms_generation_events.py' de parisneo/lollms versión 5.9.0 permite acceso no autenticado a eventos sensibles de Socket.IO. La función 'add_events' registra manejadores de eventos como 'generate_text', 'cancel_generation', 'generate_msg' y 'generate_msg_from' sin implementar comprobaciones de autenticación o autorización. Esto permite a clientes no autenticados ejecutar operaciones que consumen muchos recursos o que alteran el estado, lo que lleva a una potencial denegación de servicio, corrupción de estado y condiciones de carrera. Además, el uso de indicadores globales ('lollmsElfServer.busy', 'lollmsElfServer.cancel_gen') para la gestión de estado en un entorno multi-cliente introduce vulnerabilidades adicionales, permitiendo que las acciones de un cliente afecten el estado del servidor y las operaciones de otros clientes. La falta de un control de acceso adecuado y la dependencia de una gestión de estado global insegura impacta significativamente la disponibilidad y la integridad del servicio."
    }
  ],
  "lastModified": "2026-06-17T10:15:07.057",
  "sourceIdentifier": "security@huntr.dev"
}