https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T14:00:01.036746+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2024-6982 CVE-2024-6982 — Remote Code Execution in Calculate Function in parisneo/lollms 2026-10-03T14:00:01.038545+00:00

Affected: parisneo/lollms

A remote code execution vulnerability exists in the Calculate function of parisneo/lollms version 9.8. The vulnerability arises from the use of Python's `eval()` function to evaluate mathematical expressions within a Python sandbox that disables `__builtins__` and only allows functions from the `math` module. This sandbox can be bypassed by loading the `os` module using the `_frozen_importlib.BuiltinImporter` class, allowing an attacker to execute arbitrary commands on the server. The issue is fixed in version 9.10.

 https://cve.radiocsirt.org/vuln/ghsa-jccx-m9v4-9hwh GHSA-jccx-m9v4-9hwh — LoLLMS Code Injection vulnerability 2026-10-03T14:00:01.038616+00:00

Affected: PyPI: lollms

A remote code execution vulnerability exists in the Calculate function of parisneo/lollms version 9.8. The vulnerability arises from the use of Python's `eval()` function to evaluate mathematical expressions within a Python sandbox that disables `__builtins__` and only allows functions from the `math` module. This sandbox can be bypassed by loading the `os` module using the `_frozen_importlib.BuiltinImporter` class, allowing an attacker to execute arbitrary commands on the server. The issue is fixed in version 9.10.