Read the docs

mudler

Records11All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

mudler records in CISA KEV

No mudler vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Localai 11 records HIGH

Records

11 records

TI-2024-04809 CVE-2024-5181 · GHSA-8xc2-8m55-8q36

Command Injection in mudler/localai

Priority HIGH 82

A command injection vulnerability exists in the mudler/localai version 2.14.0.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02685 Published 2024-06-26 Fixed in 2.16.0 CWE-78
TI-2024-01889 CVE-2024-2029 · GHSA-wx43-g55g-2jf4

Command Injection in mudler/localai

Priority HIGH 82

A command injection vulnerability exists in the `TranscriptEndpoint` of mudler/localai, specifically within the `audioToWav` function used for converting audio files to WAV format for transcription.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02879 Published 2024-04-10 Fixed in v2.10.0, 2.10.0 CWE-78
TI-2024-04810 CVE-2024-5182 · GHSA-cpcx-r2gq-x893

Path Traversal in mudler/localai

Priority HIGH 78

A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parameter during the model deletion process to delete arbitrary files.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.25538 Published 2024-06-19 Fixed in 2.16.0 CWE-22
TI-2024-06369 CVE-2024-6868 · GHSA-2w8h-hch2-v23h

Arbitrary File Write in mudler/LocalAI

Priority HIGH 75

mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01544 Published 2024-10-29 Fixed in 2.18.1 CWE-59
TI-2024-06481 CVE-2024-6983 · GHSA-v6qv-c78w-ff25

Remote Code Execution in mudler/localai

Priority HIGH 73

mudler/localai version 2.17.1 is vulnerable to remote code execution.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01289 Published 2024-09-27 Fixed in 2.19.4 CWE-94
TI-2024-06505 CVE-2024-7010 · GHSA-9hcm-hr65-2825

Timing Attack in mudler/localai

Priority HIGH 66

mudler/localai version 2.17.1 is vulnerable to a Timing Attack.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00521 Published 2024-10-29 Fixed in 2.21 CWE-208
TI-2024-05648 CVE-2024-6095 · GHSA-fgv5-qx89-qjrh

SSRF and Partial LFI in /models/apply Endpoint in mudler/localai

Priority HIGH 65

A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion (LFI).

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.0265 Published 2024-07-06 Fixed in 2.17 CWE-918
TI-2024-02935 CVE-2024-3135 · GHSA-jhvf-7c85-3c9g

Cross-Site Request Forgery (CSRF) Vulnerability in mudler/localai

Priority MEDIUM 62

A Cross-Site Request Forgery (CSRF) vulnerability exists in the mudler/localai application, allowing attackers to craft malicious webpages that, when visited by a victim, perform unauthorized actions on the victim's loca…

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.00314 Published 2024-04-01 No fix listed CWE-352
TI-2024-09185 CVE-2024-9900 · GHSA-w6hh-w36c-vxmw

Cross-Site Scripting (XSS) in mudler/localai

Priority MEDIUM 60

mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00536 Published 2025-03-20 Fixed in 2.22.0 CWE-79
TI-2024-05215 CVE-2024-5616 · GHSA-chxg-pjh8-j2r6

CSRF Vulnerability in mudler/LocalAI

Priority MEDIUM 53

A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models.

CVSS 3.0MEDIUM 4.3 Network No auth User interaction EPSS 0.00254 Published 2024-07-06 Fixed in 2.17 CWE-352
Open these records in search →