MEDIUM🇵🇱 Wersja polska

CVE-2024-9900

CVSS 6.1v3.1pub. 2025-03-20upd. 2025-04-04

mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts in the context of the victim's browser, potentially compromising user sessions, stealing session cookies, redirecting users to malicious websites, or manipulating the DOM.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

  • Mudler Localai

    APP
    Mudler
    2.21.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
XSS
CWE
References

Related vulnerabilities

CVE-2024-6868CRITICAL9.8PL ✓ten sam produkt

Podatność tarslip w LocalAI umożliwiająca RCE przez arbitralny zapis pliku

CVE-2024-5181CRITICAL9.8PL ✓ten sam produkt

Command injection w LocalAI — pełne przejęcie systemu przez parametr backend

CVE-2024-5182CRITICAL9.1PL ✓ten sam produkt

Path traversal w LocalAI umożliwiający usuwanie dowolnych plików

CVE-2024-2029CRITICAL9.8PL ✓ten sam produkt

Command injection w mudler/LocalAI — endpoint transkrypcji audio

CVE-2024-6983HIGH8.8ten sam produkt

mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the loc...