Skip to content
OpenAdvisories

Package · Go

github.com/mudler/LocalAI

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.6
    CVE-2026-59707

    LocalAI - Server-Side Request Forgery via POST /models/apply

    LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFro…

    LocalAI LocalAI github.com/mudler/LocalAI Go
  • Medium 5.4
    CVE-2024-9900

    Cross-Site Scripting (XSS) in mudler/localai

    mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can le…

    mudler mudler/localai github.com/mudler/LocalAI Go
  • Medium 6.1
    CVE-2024-48057

    LocalAI Cross-site Scripting vulnerability

    localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS). When calling the delete model API and passing inappropriate parameters, it can cause a one-time storage XSS, which will trigger the payload when a user accesses the homepage.

    github.com/mudler/LocalAI Go