[GHSA-cm59-8rmv-f2cj] Lollms vulnerable to Cross-site Scripting

[jiangrui-zheng]

Updates

• Affected products

Based on https://huntr.com/bounties/ad68ecd6-44e2-449b-8e7e-f2b71b1b43c7, this was marked as fixed in version 9.9 with ParisNeo/lollms@328b960.

[shelbyc]

👋 Hi @jiangrui-zheng, you're correct that a patch for GHSA-cm59-8rmv-f2cj/CVE-2024-6581 exists. However, no version 9.9 exists for Lollms at https://github.com/parisneo/lollms or at https://pypi.org/project/lollms/#history. Because there is no version 9.9 for users of Lollms to upgrade to, the most accurate way to describe the situation is that versions up to and including 9.5.1 are vulnerable, and although a patch is available, a numbered fixed release is not available. Therefore, I believe it is best to leave the advisory as is. Thank you for your interest in GHSA-cm59-8rmv-f2cj and have a good day.