Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

11 records

Vendor: mudler Clear all filters
TI-2024-09185 CVE-2024-9900 · GHSA-w6hh-w36c-vxmw

Cross-Site Scripting (XSS) in mudler/localai

Priority MEDIUM 60

mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00536 Published 2025-03-20 Fixed in 2.22.0 CWE-79
TI-2024-06505 CVE-2024-7010 · GHSA-9hcm-hr65-2825

Timing Attack in mudler/localai

Priority HIGH 66

mudler/localai version 2.17.1 is vulnerable to a Timing Attack.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00521 Published 2024-10-29 Fixed in 2.21 CWE-208
TI-2024-06369 CVE-2024-6868 · GHSA-2w8h-hch2-v23h

Arbitrary File Write in mudler/LocalAI

Priority HIGH 75

mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01544 Published 2024-10-29 Fixed in 2.18.1 CWE-59
TI-2024-06481 CVE-2024-6983 · GHSA-v6qv-c78w-ff25

Remote Code Execution in mudler/localai

Priority HIGH 73

mudler/localai version 2.17.1 is vulnerable to remote code execution.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01289 Published 2024-09-27 Fixed in 2.19.4 CWE-94
TI-2024-05648 CVE-2024-6095 · GHSA-fgv5-qx89-qjrh

SSRF and Partial LFI in /models/apply Endpoint in mudler/localai

Priority HIGH 65

A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion (LFI).

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.0265 Published 2024-07-06 Fixed in 2.17 CWE-918
TI-2024-05215 CVE-2024-5616 · GHSA-chxg-pjh8-j2r6

CSRF Vulnerability in mudler/LocalAI

Priority MEDIUM 53

A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models.

CVSS 3.0MEDIUM 4.3 Network No auth User interaction EPSS 0.00254 Published 2024-07-06 Fixed in 2.17 CWE-352
TI-2024-04809 CVE-2024-5181 · GHSA-8xc2-8m55-8q36

Command Injection in mudler/localai

Priority HIGH 82

A command injection vulnerability exists in the mudler/localai version 2.14.0.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02685 Published 2024-06-26 Fixed in 2.16.0 CWE-78
TI-2024-04810 CVE-2024-5182 · GHSA-cpcx-r2gq-x893

Path Traversal in mudler/localai

Priority HIGH 78

A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parameter during the model deletion process to delete arbitrary files.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.25538 Published 2024-06-19 Fixed in 2.16.0 CWE-22
TI-2024-01889 CVE-2024-2029 · GHSA-wx43-g55g-2jf4

Command Injection in mudler/localai

Priority HIGH 82

A command injection vulnerability exists in the `TranscriptEndpoint` of mudler/localai, specifically within the `audioToWav` function used for converting audio files to WAV format for transcription.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02879 Published 2024-04-10 Fixed in v2.10.0, 2.10.0 CWE-78
TI-2024-02935 CVE-2024-3135 · GHSA-jhvf-7c85-3c9g

Cross-Site Request Forgery (CSRF) Vulnerability in mudler/localai

Priority MEDIUM 62

A Cross-Site Request Forgery (CSRF) vulnerability exists in the mudler/localai application, allowing attackers to craft malicious webpages that, when visited by a victim, perform unauthorized actions on the victim's loca…

CVSS 3.0MEDIUM 6.5 Network No auth User interaction EPSS 0.00314 Published 2024-04-01 No fix listed CWE-352