SCA: security update for lollms (GHSA-82fw-ch24-j34w)

high Tenable Cloud Security Plugin ID 437461

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows
unauthenticated access to sensitive Socket.IO events. The `add_events` function registers event handlers
such as `generate_text`, `cancel_generation`, `generate_msg`, and `generate_msg_from` without implementing
authentication or authorization checks. This allows unauthenticated clients to execute resource-intensive
or state-altering operations, leading to potential denial of service, state corruption, and race
conditions. Additionally, the use of global flags (`lollmsElfServer.busy`, `lollmsElfServer.cancel_gen`)
for state management in a multi-client environment introduces further vulnerabilities, enabling one
client's actions to affect the server's state and other clients' operations. The lack of proper access
control and reliance on insecure global state management significantly impacts the availability and
integrity of the service. (CVE-2026-1117)

Plugin Details

Severity: High

ID: 437461

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 2/3/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.5

Percentile: 52.04

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 6.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:C

CVSS Score Source: CVE-2026-1117

CVSS v3

Risk Factor: High

Base Score: 8.2

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 2/2/2026

Vulnerability Publication Date: 2/2/2026

Reference Information

CVE: CVE-2026-1117

cwe: CWE-284

Detections

Analytics