CVE-2024-1601 is a critical (CVSS 9.8) SQL injection in the delete_discussion() function of parisneo/lollms-webui. A crafted HTTP POST to the /delete_discussion endpoint can delete all records from the discussion and message tables. The record names no fixed version, so use the referenced commit.
What's affected
The record describes the flaw in the delete_discussion() function, reached through the /delete_discussion endpoint, via the id parameter. It lists a fix commit in the project repository and a huntr report. I did not retrieve either.
No version range or fixed release is named. Compare your checkout or install against the referenced commit to know whether you have the fix.
How to check if you're exposed
Find your installed build's commit:
git -C /path/to/lollms-webui log -1 --format=%H
Then see whether the commit referenced by the record is part of your history. Also check whether the service is reachable from other machines, because the record describes an HTTP request that needs no login.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Find all lollms-webui installations and their commits.
- Update to a build that contains the fix commit.
- Bind the service to localhost or add authentication.
- Back up the discussions database regularly.
- Review the database for missing records if you ran an exposed instance.
Why it matters
The record classes this as CWE-89, SQL injection. The identifier was placed into a SQL statement without neutralizing special characters, so the supplied text changed the meaning of the delete.
The impact described is loss of data, since all discussions and messages can be deleted. For a personal tool this might be only annoying, but for a shared deployment it may be real work lost. The record's KEV flag is false. Whatever you decide about patching, keep regular backups of the database file, since a destructive request is hard to undo without one, and avoid placing the application on a network that other people can reach.
Quick check
What can the attacker do?
Delete all records from the discussion and message tables, per the record.
Is there a fixed version?
The record points to a fix commit and names no release.
Sources
- Fix commit (listed in the NVD record, not retrieved)
- huntr report (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1601
Last reviewed: 19 October 2026.
