mudler

4 results · Clear filters · Feed

• Medium 5.4
  CVE-2024-9900

  Cross-Site Scripting (XSS) in mudler/localai

  mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can le…

  mudler mudler/localai github.com/mudler/LocalAI Go
  Mar 20, 2025
• Medium 5.8
  CVE-2024-6095 Public exploit

  SSRF and Partial LFI in /models/apply Endpoint in mudler/localai

  A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion (LFI). The endpoint supports both http(s):// and file:// schemes, where the latter can lead to LFI. …

  mudler mudler/localai
  Jul 6, 2024
• Medium 4.3
  CVE-2024-5616

  CSRF Vulnerability in mudler/LocalAI

  A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a …

  mudler mudler/localai
  Jul 6, 2024
• Medium 6.5
  CVE-2024-3135

  Cross-Site Request Forgery (CSRF) Vulnerability in mudler/localai

  A Cross-Site Request Forgery (CSRF) vulnerability exists in the mudler/localai application, allowing attackers to craft malicious webpages that, when visited by a victim, perform unauthorized actions on the victim's local LocalAI instance without their consen…

  mudler mudler/localai github.com/go-skynet/LocalAI Go
  Apr 1, 2024