AI Threat Alert
CVE-2024-6581: Lollms: SVG upload XSS enables session hijack and RCE
GHSA-cm59-8rmv-f2cj MEDIUM CISA: TRACK*If your team runs self-hosted Lollms for AI-assisted collaboration, any authenticated user can upload a crafted SVG to trigger XSS against other users — including admins — potentially escalating to RCE via Lollms' local filesystem and API access. Patch immediately to the fixed commit (328b960) or disable SVG uploads at the reverse proxy. Low privilege requirement makes this a realistic insider or compromised-account threat vector in AI lab environments.
What is the risk?
Rated CVSS 6.5 Medium but contextually elevated for AI teams using Lollms as a multi-user platform. The incomplete blocklist-based sanitize_svg — which only strips <script> and on* attributes — misses well-documented SVG XSS vectors: <foreignObject>, <use xlink:href>, <image href>, CSS expression attacks, and data: URI payloads. In self-hosted AI deployments where Lollms has filesystem and model config access, XSS-to-RCE is a realistic escalation chain. EPSS at 1.6% reflects limited public exploitation, but proof-of-concept SVG payloads for these bypass classes are trivially available.
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| LoLLMs | pip | <= 9.5.1 | No patch |
Do you use LoLLMs? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step-
1) Patch: Pull commit 328b960 or upgrade lollms pip package beyond 9.5.1. 2) Immediate workaround: Block SVG MIME type uploads at nginx/Apache/reverse proxy layer — one-line config change. 3) Harden sanitization: Replace the blocklist-based sanitize_svg with DOMPurify configured with SVG namespace restrictions and a strict allowlist of safe SVG elements. 4) Add CSP: Implement Content-Security-Policy with default-src 'self', disabling inline scripts and restricting resource origins. 5) Detection: Query web server access logs for POST requests uploading .svg files; search stored SVGs for foreignObject, xlink, data:, javascript: strings. 6) Audit: Review all SVG files already stored on the instance for malicious payloads.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2024-6581?
If your team runs self-hosted Lollms for AI-assisted collaboration, any authenticated user can upload a crafted SVG to trigger XSS against other users — including admins — potentially escalating to RCE via Lollms' local filesystem and API access. Patch immediately to the fixed commit (328b960) or disable SVG uploads at the reverse proxy. Low privilege requirement makes this a realistic insider or compromised-account threat vector in AI lab environments.
Is CVE-2024-6581 actively exploited?
No confirmed active exploitation of CVE-2024-6581 has been reported, but organizations should still patch proactively.
How to fix CVE-2024-6581?
1) Patch: Pull commit 328b960 or upgrade lollms pip package beyond 9.5.1. 2) Immediate workaround: Block SVG MIME type uploads at nginx/Apache/reverse proxy layer — one-line config change. 3) Harden sanitization: Replace the blocklist-based sanitize_svg with DOMPurify configured with SVG namespace restrictions and a strict allowlist of safe SVG elements. 4) Add CSP: Implement Content-Security-Policy with default-src 'self', disabling inline scripts and restricting resource origins. 5) Detection: Query web server access logs for POST requests uploading .svg files; search stored SVGs for foreignObject, xlink, data:, javascript: strings. 6) Audit: Review all SVG files already stored on the instance for malicious payloads.
What systems are affected by CVE-2024-6581?
This vulnerability affects the following AI/ML architecture patterns: Self-hosted LLM frontends and chat interfaces, Multi-user AI collaboration platforms, Agent frameworks with web UI, On-premise AI development workspaces.
What is the CVSS score for CVE-2024-6581?
CVE-2024-6581 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.60%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0011 User Execution AML.T0011.003 Malicious Link AML.T0049 Exploit Public-Facing Application AML.T0078 Drive-by Compromise Compliance Controls Affected
What are the technical details?
Original Advisory
A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files. Due to incomplete filtering in the sanitize_svg function, this can lead to cross-site scripting (XSS) vulnerabilities, which in turn pose a risk of remote code execution. The sanitize_svg function only removes script elements and 'on*' event attributes, but does not account for other potential vectors for XSS within SVG files. This vulnerability can be exploited when authorized users access a malicious URL containing the crafted SVG file.
Exploitation Scenario
An attacker with a free or low-privilege Lollms account uploads a crafted SVG to a discussion thread. The SVG uses a <foreignObject> tag embedding an HTML fragment with a script element — a vector ignored by sanitize_svg's blocklist. The attacker sends a targeted URL to an admin (via email, Slack, or the discussion thread itself). When the admin's browser renders the SVG, the XSS payload fires: it exfiltrates the admin's session cookie and any API keys visible in the page DOM to an attacker-controlled endpoint. With the admin session, the attacker gains full Lollms control, including access to local filesystem bindings, model configurations, and Lollms' code execution extensions — escalating from XSS to RCE.
Weaknesses (CWE)
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
- [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Examples of libraries and frameworks that make it easier to generate properly encoded output include Microsoft's Anti-XSS library, the OWASP ESAPI Encoding module, and Apache Wicket.
- [Implementation, Architecture and Design] Understand the context in which your data will be used and the encoding that will be expected. This is especially important when transmitting data between different components, or when generating outputs that can contain multiple encodings at the same time, such as web pages or multi-part mail messages. Study all expected communication protocols and data representations to determine the required encoding strategies. For any data that will be output to another web page, especially any data that was received from external inputs, use the appropriate encoding on all non-alphanumeric characters. Parts of the same output document may require different encodings, which will vary depending on whether the output is in the: etc. Note that HTML Entity Encoding is only appropriate for the HTML body. Consult the XSS Prevention Cheat Sheet [REF-724] for more details on the types of encoding and escaping that are needed. HTML body Element attributes (such as src="XYZ") URIs JavaScript sections Casca
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L References
Timeline
Related Vulnerabilities
CVE-2026-1115 9.6 lollms: Stored XSS enables wormable account takeover
Same package: lollms CVE-2024-6982 8.4 lollms: RCE via eval() sandbox bypass in Calculate
Same package: lollms CVE-2026-1117 8.2 lollms: Access Control bypass enables privilege escalation
Same package: lollms CVE-2025-6386 7.5 lollms: timing attack enables credential enumeration
Same package: lollms CVE-2024-6985 4.4 lollms: path traversal allows arbitrary directory read
Same package: lollms