CVE-2024-9309

PoC —

CVSS 3.0

9.3 critical

EPSS

<1%p41

Published

Mar 20, 2025 (Mar 20, 2025)

Modified

Jun 17, 2026

Description

A Server-Side Request Forgery (SSRF) vulnerability exists in the POST /worker_generate_stream API endpoint of the Controller API Server in haotian-liu/llava version v1.2.0 (LLaVA-1.6). This vulnerability allows attackers to exploit the victim Controller API Server's credentials to perform unauthorized web actions or access unauthorized web resources.

Vendors: hliu
Products: llava
Weakness: CWE-918
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.