CVE-2024-9311

The vulnerability CVE-2024-9311 affects haotian-liu/llava v1.2.0 (LLaVA-1.6). A CSRF flaw lets an attacker upload files with malicious content without authentication, storing them in a predictable path and enabling arbitrary JavaScript execution in the victim’s browser when visiting the crafted f...

CVE-2024-11449

CVE-2024-11449 stems from haotian-liu/llava v1.2.0 (LLaVA-1.6) with insufficient validation of the path parameter on the "/run/predict" endpoint, enabling Server-Side Request Forgery (SSRF). An attacker can access internal networks or AWS metadata by sending crafted requests, leading to unauthori...

CVE-2024-12070

CVE-2024-12070 concerns a DoS vulnerability in the file upload feature of haotian-liu/llava (Release v1.2.0 / LLaVA-1.6). The root cause is improper handling of form-data with an excessively large filename in the file upload request, which can overwhelm the server and render it unresponsive. Expl...