PyPI/lollms CVE-2025-6386: high 7.5, EPSS 0.41%
Lord of Large Language Models vulnerable to Observable Discrepancy attack via authenticate_user function
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | - | 11.0.0 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-j5pr-vrjj-9v4h
- https://nvd.nist.gov/vuln/detail/CVE-2025-6386
- https://github.com/parisneo/lollms/commit/f78437f7b5aa39a78c6201912faf4e0645a38c48
- https://github.com/ParisNeo/lollms
- https://huntr.com/bounties/6da05485-d219-4f18-9ffc-991053524b67
CVE-2025-6386 · published · modified · JSON