CVE-2024-6982 Overview
CVE-2024-6982 is a remote code execution vulnerability in the Calculate function of parisneo/lollms version 9.8. The flaw allows attackers to escape a Python sandbox intended to safely evaluate mathematical expressions. The sandbox relies on Python's eval() with __builtins__ disabled, exposing only functions from the math module. Attackers bypass this restriction by referencing the _frozen_importlib.BuiltinImporter class to load the os module and execute arbitrary operating system commands. The issue is fixed in version 9.10.
Critical Impact
Successful exploitation grants attackers arbitrary command execution on the host running lollms, leading to full compromise of confidentiality, integrity, and availability [CWE-94].
Affected Products
- parisneo/lollms version 9.8
- Any deployment exposing the Calculate function prior to version 9.10
- Fixed in parisneo/lollms version 9.10
Discovery Timeline
- 2025-03-20 - CVE-2024-6982 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-6982
Vulnerability Analysis
The Calculate function in parisneo/lollms evaluates user-supplied mathematical expressions using Python's built-in eval(). The developer implemented a sandbox by clearing __builtins__ and restricting the global namespace to functions imported from the math module. This design assumes that removing builtins prevents access to dangerous callables such as open, exec, or __import__.
The sandbox does not account for object introspection via class hierarchies. Python objects expose their class chain through __class__, __bases__, and __subclasses__, which remain reachable inside the restricted eval() context. Attackers walk this chain to locate _frozen_importlib.BuiltinImporter, then call its load_module method to import os and invoke system or popen. Once os is loaded, arbitrary shell commands run under the lollms process account.
Root Cause
The root cause is unsafe use of eval() for user input combined with an incomplete sandbox model [CWE-94: Improper Control of Generation of Code]. Disabling __builtins__ alone does not remove the ability to traverse object metaclasses and reach import machinery still present in the interpreter.
Attack Vector
An attacker with access to the Calculate feature submits a crafted mathematical expression string. The payload navigates from a benign object literal through __class__.__mro__ to reach object, enumerates __subclasses__(), locates BuiltinImporter, and imports os. The final expression invokes os.system or equivalent to run attacker-controlled commands. No authentication is required per the CVSS vector, and interaction is local to the application interface.
See the Huntr Bounty Report for the full proof-of-concept technique.
Detection Methods for CVE-2024-6982
Indicators of Compromise
- Unexpected child processes spawned by the lollms Python interpreter, especially shells such as /bin/sh, /bin/bash, or cmd.exe.
- Application logs containing Calculate requests with strings referencing __class__, __subclasses__, __mro__, BuiltinImporter, or _frozen_importlib.
- Outbound network connections initiated from the lollms process to unfamiliar hosts following a Calculate invocation.
Detection Strategies
- Inspect HTTP request bodies to the Calculate endpoint for Python dunder attributes or import-related identifiers.
- Correlate lollms process telemetry with process creation events to detect any non-Python child processes.
- Baseline the lollms service behavior and alert on deviations such as file writes outside its working directory or new listening sockets.
Monitoring Recommendations
- Forward lollms application and system logs to a centralized analytics platform for retention and query.
- Monitor filesystem access to sensitive locations such as /etc/passwd, SSH key stores, and cloud credential files from the lollms process.
- Track version metadata of deployed lollms instances to confirm all hosts are running 9.10 or later.
How to Mitigate CVE-2024-6982
Immediate Actions Required
- Upgrade parisneo/lollms to version 9.10 or later, which removes the vulnerable sandbox pattern.
- Restrict network exposure of the lollms interface to trusted users while patching is planned.
- Audit recent Calculate requests and process execution logs for signs of prior exploitation.
Patch Information
The maintainers addressed the issue in version 9.10. Review the fix in the GitHub Commit Update to confirm the replacement of eval() with a safer expression evaluator.
Workarounds
- Disable or remove the Calculate feature until the upgrade is applied.
- Run the lollms service under a dedicated low-privilege account with no shell access and constrained filesystem permissions.
- Apply outbound network egress filtering so the lollms process cannot reach arbitrary internet destinations.
# Configuration example: upgrade lollms and run with reduced privileges
pip install --upgrade lollms>=9.10
useradd --system --shell /usr/sbin/nologin lollms
sudo -u lollms lollms-server --host 127.0.0.1
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
