CVE-2024-4897: Lollms Web UI Remote Code Execution Flaw

CVE-2024-4897 Overview

CVE-2024-4897 affects parisneo/lollms-webui, a web interface for large language models. The vulnerability allows remote code execution through the binding_zoo feature, which processes model files in GGUF format. The root cause is an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64, which carries the unpatched flaw tracked as CVE-2024-34359. Attackers can upload or reference a malicious model file hosted on Hugging Face and trigger code execution when the application loads it. The issue remained unpatched in lollms-webui as of commit b454f40a.

Critical Impact
An attacker who convinces the application to load a crafted GGUF model file achieves arbitrary code execution on the host running lollms-webui, resulting in full compromise of confidentiality, integrity, and availability.

Affected Products

parisneo/lollms-webui (latest as of commit b454f40a)
llama-cpp-python version 0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64
Deployments using the bindings_zoo feature with GGUF model files

Discovery Timeline

2024-07-02 - CVE-2024-4897 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-4897

Vulnerability Analysis

The vulnerability is a Remote Code Execution flaw introduced through an insecure third-party dependency [CWE-76]. The binding_zoo feature in lollms-webui lets users select and load model bindings, including files pulled from Hugging Face. When a user loads a GGUF model, the application delegates parsing to llama-cpp-python. That library contains CVE-2024-34359, a Jinja2 template injection flaw in its chat template handling. Loading an attacker-controlled model file causes malicious template content embedded in the model metadata to be rendered and executed in the server process.

Root Cause

The root cause is unsafe rendering of Jinja2 templates read from GGUF model metadata inside llama-cpp-python. Templates are rendered without sandboxing, so a crafted template can invoke arbitrary Python code. lollms-webui inherits this risk because it pins a vulnerable version of llama-cpp-python and exposes model loading through its bindings_zoo feature.

Attack Vector

An attacker hosts a malicious GGUF model on Hugging Face or another accessible source. The attacker then induces a lollms-webui user to select that model through the bindings_zoo interface, or supplies it directly on a self-hosted instance. When lollms-webui invokes llama-cpp-python to load the model, the embedded Jinja2 payload executes with the privileges of the lollms-webui process. The CVSS vector indicates a local attack vector with no privileges or user interaction required beyond the model load action. See the Huntr bounty report for reproduction details.

Detection Methods for CVE-2024-4897

Indicators of Compromise

Unexpected child processes spawned by the Python interpreter hosting lollms-webui (for example, sh, bash, python, or network utilities).
New or modified GGUF files in the bindings_zoo model directory that were not placed there by an administrator.
Outbound network connections from the lollms-webui process to attacker-controlled hosts shortly after a model load event.

Detection Strategies

Inspect installed dependency versions and flag any environment running llama-cpp-python at or below 0.2.61 when paired with lollms-webui.
Monitor process lineage under the lollms-webui service and alert on execution of shells, interpreters, or reconnaissance tools as descendants of the Python runtime.
Scan GGUF files for Jinja2 template syntax in chat template metadata fields, particularly constructs referencing __class__, __mro__, or subprocess.

Monitoring Recommendations

Enable file integrity monitoring on directories that store model files loaded by lollms-webui.
Log every model load event with the source URL, file hash, and initiating user for forensic review.
Alert on egress traffic from AI inference hosts to unclassified destinations, since compromised model loaders often initiate outbound callbacks.

How to Mitigate CVE-2024-4897

Immediate Actions Required

Disable the bindings_zoo model upload and remote model download workflows until the underlying dependency is upgraded.
Upgrade llama-cpp-python to a version that patches CVE-2024-34359 and remove the vulnerable 0.2.61 wheel from the environment.
Restrict model sources to a curated allowlist of trusted publishers and verify file hashes before loading.

Patch Information

As of commit b454f40a, lollms-webui had not shipped a fix for this dependency issue. Operators should track upstream commits to parisneo/lollms-webui and pin a patched build of llama-cpp-python that addresses CVE-2024-34359. Refer to the Huntr bounty summary for current status.

Workarounds

Run lollms-webui inside a hardened container with a read-only filesystem, no outbound internet access, and a non-privileged user account.
Enforce network egress filtering that blocks the inference host from reaching arbitrary internet destinations.
Require code review and hash pinning for any GGUF file placed into the bindings_zoo directory.

bash

# Configuration example: pin a patched llama-cpp-python and isolate the service
pip uninstall -y llama-cpp-python
pip install "llama-cpp-python>=0.2.72"  # verify version fixes CVE-2024-34359

# Run lollms-webui as a non-root user with restricted egress
useradd -r -s /usr/sbin/nologin lollms
sudo -u lollms python -m lollms_webui --host 127.0.0.1 --port 9600