CVE-2024-10131

The addllm function in llmapp.py in infiniflow/ragflow version 0.11.0 contains a remote code execution RCE vulnerability. The function uses user-supplied input req'llmfactory' and req'llmname' to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to...

CVE-2024-10131 Remote Code Execution in infiniflow/ragflow

The addllm function in llmapp.py in infiniflow/ragflow version 0.11.0 contains a remote code execution RCE vulnerability. The function uses user-supplied input req'llmfactory' and req'llmname' to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to...

CVE-2024-10131 Remote Code Execution in infiniflow/ragflow

The addllm function in llmapp.py in infiniflow/ragflow version 0.11.0 contains a remote code execution RCE vulnerability. The function uses user-supplied input req'llmfactory' and req'llmname' to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to...

CVE-2024-10131 Remote Code Execution in infiniflow/ragflow

The addllm function in llmapp.py in infiniflow/ragflow version 0.11.0 contains a remote code execution RCE vulnerability. The function uses user-supplied input req'llmfactory' and req'llmname' to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to...

CVE-2024-10131

The "addllm" function in "llmapp.py" in infiniflow/ragflow version 0.11.0 contains a remote code execution RCE vulnerability. The function uses user-supplied input "req'llmfactory'" and "req'llmname'" to dynamically instantiate classes from various model dictionaries. This approach allows an...

CVE-2024-10131: Improper Control of Generation of Code

The addllm function in llmapp.py in infiniflow/ragflow version 0.11.0 contains a remote code execution RCE vulnerability. The function uses user-supplied input req'llmfactory' and req'llmname' to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to...

RAGFlow command injection vulnerability

RAGFlow is an open source RAG engine based on deep document understanding from InfiniFlow Open Source. A command injection vulnerability exists in RAGFlow version 0.11.0, which stems from a lack of comprehensive input validation or cleanup, causing the addllm function in llmapp.py to contain a...

PT-2024-16051 · Infiniflow · Ragflow

Name of the Vulnerable Software and Affected Versions: infiniflow/ragflow version 0.11.0 Description: The issue concerns a remote code execution vulnerability in the add llm function, located in llm app.py. This function utilizes user-supplied input, specifically req'llm factory' and req'llm name...