CVE-2024-1569 is a high severity (CVSS 7.5) denial of service in parisneo/lollms-webui. Repeated unauthenticated HTTP POST requests to the /open_code_in_vs_code endpoint and similar ones open Visual Studio Code or the default folder opener many times, which can exhaust the host's resources. The record names no fixed version.
What's affected
The record says the flaw is present in the latest version at the time of the report, and names the /open_code_in_vs_code endpoint "and similar endpoints". It lists a commit in the project repository and a huntr report as references, and I did not retrieve either.
No fixed release is named. Use the commit and the project's releases page to find the first release that includes the change, and compare it with what you run.
How to check if you're exposed
Find out where lollms-webui runs and how it is exposed. Check the version of the installed package or the git commit of your checkout:
git -C /path/to/lollms-webui log -1 --format=%H
Then confirm whether the web interface listens on anything other than localhost. A tool meant for one user's desktop is easy to expose by accident when bound to all interfaces.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Find every lollms-webui installation.
- Update to a build that includes the referenced fix commit.
- Bind the service to localhost or place it behind authentication.
- Block access from the network with a host firewall.
- Run it on a machine where resource exhaustion cannot affect other services.
Why it matters
The record classes this as CWE-400, uncontrolled resource consumption. Endpoints that launch desktop programs had no authentication and no rate limit, so repeated calls could pile up processes until the machine stopped responding.
The weakness shows a common risk with local AI tools: they are built as personal apps and then exposed on a network. The record's KEV flag is false and it does not describe in-the-wild abuse.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does it need a login?
No. The record says no authentication is needed.
How can I reduce risk today?
Bind to localhost and block network access until you update.
Sources
- Fix commit (listed in the NVD record, not retrieved)
- huntr report (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1569
Last reviewed: 19 October 2026.
