CVE-2024-49375: Rasa Remote Code Execution Vulnerability
Summary
CVE-2024-49375: Rasa Allows Remote Code Execution via Remote Model Loading. Affects rasa versions < 3.6.21. Fixed in 3.6.21. How to fix ↓
Also tracked for
The same CVE-2024-49375 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Rasa is an open-source machine learning framework designed for building contextual AI assistants and chatbots. It provides tools for natural language understanding and dialogue management, enabling developers to create conversational agents that can understand user intents and manage conversations effectively. However, a critical vulnerability has been identified that allows remote code execution when loading malicious models remotely.
Vulnerability Detail
A vulnerability exists in Rasa Pro and Rasa Open Source that allows an attacker to achieve remote code execution (RCE) by loading a maliciously crafted model into a Rasa instance. This vulnerability can be exploited if the HTTP API is enabled and if proper authentication measures are not in place. Unauthenticated RCE is possible if no security controls are configured, while authenticated RCE requires possession of a valid authentication token or JWT. The affected components include various classifiers and featurizers, which, if exploited, can lead to severe security breaches.
How To Fix
Latest published version: 3.6.21 as of 22 Oct 2026
pip install --upgrade "rasa==3.6.21"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
To mitigate the risk of unauthenticated RCE, enable authentication for the Rasa HTTP API by configuring it as described in the Rasa documentation. For authenticated RCE, ensure that models are only loaded from trusted sources and implement strict access controls to limit who can interact with the Rasa API.
Conclusion
The identified vulnerability in Rasa allows for remote code execution through the loading of malicious models. It is crucial for users to upgrade to the patched versions to mitigate this risk. Additionally, implementing proper authentication and access controls can further enhance security against potential exploits.
See every vulnerability recorded for rasa →
FAQ
The CVSS score of this vulnerability is 9.0, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploiting this vulnerability can lead to remote code execution, allowing attackers to execute arbitrary code on the server, potentially compromising sensitive data and system integrity.
Yes, you can mitigate the risk by enabling authentication for the Rasa HTTP API and ensuring that only trusted models are loaded.
The affected components include CountVectorFeaturizer, LexicalSyntacticFeaturizer, LogisticRegressionClassifier, SklearnIntentClassifier, DIETClassifier, CRFEntityExtractor, TrackerFeaturizer, TEDPolicy, and UnexpectedIntentTEDPolicy.
References
Related vulnerabilities
Recent vulnerabilities recorded for rasa.
