CVE-2024-10131
highpriority · track · 35EPSS 0.011 · 67 %ileEUUSEPSS · scored 2026-10-27
The `add_llm` function in `llm_app.py` in infiniflow/ragflow version 0.11.0 contains a remote code execution (RCE) vulnerability. The function uses user-supplied input `req['llm_factory']` and `req['llm_name']` to dynamically instantiate classes from various model dictionaries. This approach allows an attacker to potentially execute arbitrary code due to the lack of comprehensive input validation or sanitization. An attacker could provide a malicious value for 'llm_factory' that, when used as an index to these model dictionaries, results in the execution of arbitrary code.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (2)
Products and version ranges known to be affected.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (5)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2024-10131/cnnvd
- https://github.com/infiniflow/ragflow/releases/tag/v0.12.0Patchcnnvd
- https://huntr.com/bounties/42ae0b27-e851-4b58-a991-f691a437fbaacnnvd
- https://huntr.com/bounties/42ae0b27-e851-4b58-a991-f691a437fbaaenisa_euvd
- https://huntr.com/bounties/42ae0b27-e851-4b58-a991-f691a437fbaaExploitThird Party Advisorynvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan