CVE-2024-10131

The "addllm" function in "llmapp.py" in infiniflow/ragflow version 0.11.0 contains a remote code execution RCE vulnerability. The function uses user-supplied input "req'llmfactory'" and "req'llmname'" to dynamically instantiate classes from various model dictionaries. This approach allows an...