CVE-2024-4403 is a High (CVSS 8.8) cross site request forgery in the restart_program function of lollms-webui 9.6. A crafted form can reset the program without the user knowing, which disrupts installs of the Binding zoo and Models zoo. No fixed version is on record. Update to a newer release.
What's affected
- Product: lollms-webui, version 9.6.
- Affected function: restart_program, which has no CSRF protection.
- Fixed version: not stated in the record. Its only reference is a huntr report I did not fetch.
- Severity: High, CVSS 8.8. The vector shows high confidentiality, integrity and availability impact with user interaction required. The description itself only describes unexpected resets, so the high confidentiality and integrity ratings are the scorer's reading and worth noting. I found no description detail that explains them.
- Exploitation: KEV is false.
How to check if you're exposed
Check your lollms-webui version. If it is 9.6, you match the record. Look at how you use it. Interrupted installs of bindings or models are the symptom the description gives, so unexplained restarts and half finished installs are worth a look.
Browser hygiene matters here as well, since the attack runs through the user's own browser.
What to do now
- Upgrade lollms-webui beyond 9.6.
- Finish or redo any model or binding install that was interrupted unexpectedly, and verify downloads.
- Do not browse untrusted sites in the same browser while the UI is open.
- Restrict the service to localhost or a trusted network.
- Review the install folders for files you did not add.
Why it matters
The record maps this to CWE-352, cross site request forgery. The restart function checks nothing about where the request came from, so a form on another site can submit it from the user's browser.
This record and CVE-2024-4328 show a pattern. Local AI tools often ship convenience routes with no request validation, because they assume a single trusted user. Once the tool runs a web server, that assumption stops holding.
Quick check
What can an attacker actually do here?
The description says reset the program and disrupt installs. The score is higher than that suggests, so read the huntr report for the exact reasoning.
Do I need to be logged in to anything?
The vector says no privileges are required, but the user must take an action such as visiting a page.
Scan your own dependencies
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks a manifest against known advisories, and the Gold directory keeps this record's details in one place.
Sources
The NVD record for CVE-2024-4403 (published 2024-06-10) supplied the description, score and weakness data. Pages marked fetched were read for this post. The others are listed in the record and were not read.
Last reviewed: 19 October 2026.
