CVE-2024-3126: Lollms Web UI Command Injection RCE Vulnerability

CVE-2024-3126 Overview

CVE-2024-3126 is a command injection vulnerability in the run_xtts_api_server function of the parisneo/lollms-webui application. The flaw resides in the lollms_xtts.py script, where subprocess.Popen executes a command built from a Python f-string containing the unsanitized xtts_base_url parameter. An attacker who can supply the xtts_base_url value can inject arbitrary operating system commands. Successful exploitation leads to arbitrary code execution on the host running the application. The issue affects all versions prior to 9.5 and is classified under [CWE-78] (Improper Neutralization of Special Elements used in an OS Command).

Critical Impact
Attackers can achieve arbitrary remote code execution on the lollms-webui host by manipulating the xtts_base_url parameter passed to subprocess.Popen.

Affected Products

parisneo/lollms-webui versions prior to 9.5
lollms_xtts.py script within the lollms-webui codebase
Deployments exposing the XTTS API server startup endpoint

Discovery Timeline

2024-05-16 - CVE-2024-3126 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-3126

Vulnerability Analysis

The run_xtts_api_server function launches an external XTTS process through subprocess.Popen. The command string is assembled with a Python f-string that interpolates the xtts_base_url value directly into the shell command. Because the parameter is neither validated nor escaped, shell metacharacters passed via xtts_base_url are executed by the operating system. This creates an OS command injection primitive that runs with the privileges of the lollms-webui process.

An attacker able to reach the endpoint that triggers server startup can supply a crafted URL string containing command separators or subshell syntax. The injected payload runs alongside the intended XTTS server invocation. The vulnerability is tracked under [CWE-78].

Root Cause

The root cause is the construction of an OS command using string interpolation without input validation, whitelisting, or shell-safe argument passing. Passing a list of arguments to subprocess.Popen with shell=False, or applying URL parsing and strict schema validation on xtts_base_url, would have prevented the injection.

Attack Vector

The attack vector is local per the CVSS metrics, meaning the attacker must have access to the interface that supplies the xtts_base_url parameter to the vulnerable function. No authentication or user interaction is required. Once the crafted input reaches the function, the injected commands execute as the process user.

python

# Patch excerpt from endpoints/lollms_advanced.py
 import subprocess   
 from typing import Optional
 
-# Regular expression pattern to validate file paths
-FILE_PATH_REGEX = r'^[a-zA-Z0-9_\-\\\/]+$'
+from lollms.security import sanitize_path
 
-# Function to validate file paths using the regex pattern
 def validate_file_path(path):
-    return re.match(FILE_PATH_REGEX, path)
+    try:
+        sanitized_path = sanitize_path(path, allow_absolute_path=False)
+        return sanitized_path is not None
+    except Exception as e:
+        print(f"Path validation error: {str(e)}")
+        return False

Source: parisneo/lollms-webui commit 41dbb1b

Detection Methods for CVE-2024-3126

Indicators of Compromise

Unexpected child processes spawned by the lollms-webui Python interpreter, particularly shell interpreters (/bin/sh, bash, cmd.exe) or reconnaissance tools.
Outbound network connections from the lollms-webui host to unfamiliar hosts shortly after XTTS server startup requests.
Log entries showing xtts_base_url values that contain shell metacharacters such as ;, &&, |, backticks, or $(...) syntax.

Detection Strategies

Monitor process ancestry for subprocess.Popen descendants of the lollms-webui process that are not the expected XTTS binary.
Inspect application logs and HTTP request bodies for non-URL characters in the xtts_base_url parameter and alert on failed URL parsing.
Compare deployed versions of lollms_xtts.py against the patched upstream to identify unpatched instances in the environment.

Monitoring Recommendations

Enable command-line auditing on hosts running lollms-webui and forward events to a central log platform for correlation.
Track file integrity for scripts in the lollms-webui installation directory to detect tampering or downgrade.
Alert on new listening sockets, cron jobs, or systemd units created by the application user following API interactions.

How to Mitigate CVE-2024-3126

Immediate Actions Required

Upgrade parisneo/lollms-webui to version 9.5 or later, which incorporates the fixes in commit 41dbb1b3f2e78ea276e5269544e50514252c0c25.
Restrict network access to the lollms-webui interface so that only trusted users can reach endpoints that influence xtts_base_url.
Run the application as a non-privileged service account isolated from sensitive data and secrets.

Patch Information

The upstream project addressed the issue in commit 41dbb1b3f2e78ea276e5269544e50514252c0c25, which introduces sanitize_path and forbid_remote_access helpers from lollms.security and replaces ad hoc regex validation. Details are available in the GitHub commit and the Huntr bounty report.

Workarounds

If patching is not immediately possible, block or proxy the endpoint that invokes run_xtts_api_server and validate the xtts_base_url parameter against a strict URL schema before forwarding.
Deploy the application inside a container or sandbox with no shell utilities and minimal file system access to limit the impact of injection.
Disable the XTTS integration entirely in configuration if it is not required by the deployment.

bash

# Example: run lollms-webui under a restricted systemd unit
[Service]
User=lollms
Group=lollms
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
CapabilityBoundingSet=
RestrictAddressFamilies=AF_INET AF_INET6