CVE-2024-10131

CVE-2024-10131 affects infiniflow/ragflow 0.11.0. The add_llm function dynamically instantiates classes from model dictionaries using user-controlled req['llm_factory'] and req['llm_name'], enabling remote code execution due to insufficient input validation. Connected sources corroborate RCE risk...

CVE-2024-10131 Remote Code Execution in infiniflow/ragflow

The addllm function in llmapp.py in infiniflow/ragflow version 0.11.0 contains a remote code execution RCE vulnerability. The function uses user-supplied input req'llmfactory' and req'llmname' to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to...