https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 21:08:14 +0000 https://cve.radiocsirt.org/vuln/cve-2024-3121 <p><strong>Affected:</strong> parisneo/lollms, parisneo lollms</p> <p>A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the env_name and python_version parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the &#39;whoami&#39; command among potentially other harmful commands.</p> <p><strong>Affected:</strong> parisneo/lollms, parisneo lollms</p> <p>A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the env_name and python_version parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the &#39;whoami&#39; command among potentially other harmful commands.</p> https://cve.radiocsirt.org/vuln/cve-2024-3121 https://cve.radiocsirt.org/vuln/pysec-2026-1584 <p><strong>Affected:</strong> PyPI: lollms</p> <p>A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the env_name and python_version parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the &#39;whoami&#39; command among potentially other harmful commands.</p> <p><strong>Affected:</strong> PyPI: lollms</p> <p>A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the env_name and python_version parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the &#39;whoami&#39; command among potentially other harmful commands.</p> https://cve.radiocsirt.org/vuln/pysec-2026-1584