mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts in the context of the victim's browser, potentially compromising user sessions, stealing session cookies, redirecting users to malicious websites, or manipulating the DOM.
References
| Link | Resource |
|---|---|
| https://github.com/mudler/localai/commit/a1634b219a4e52813e70ff07e6376a01449c4515 | Patch |
| https://huntr.com/bounties/b39cd230-db66-471b-89b9-24afaa078e68 | Exploit Third Party Advisory |
| https://huntr.com/bounties/b39cd230-db66-471b-89b9-24afaa078e68 | Exploit Third Party Advisory |
Configurations
History
03 Apr 2025, 18:04
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mudler
Mudler localai |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| CPE | cpe:2.3:a:mudler:localai:2.21.1:*:*:*:*:*:*:* | |
| CWE | CWE-79 | |
| References | () https://huntr.com/bounties/b39cd230-db66-471b-89b9-24afaa078e68 - Exploit, Third Party Advisory | |
| References | () https://github.com/mudler/localai/commit/a1634b219a4e52813e70ff07e6376a01449c4515 - Patch |
20 Mar 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-04-04 09:15
NVD link : CVE-2024-9900
Mitre link : CVE-2024-9900
JSON object : View
Products Affected
mudler
- localai
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')