CVE-2024-6868 Arbitrary File Write in mudler/LocalAI

mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction. When model configurations specify additional files as archives e.g., .tar, these archives are automatically extracted after downloading. This behavior can be exploited to perfor...

CVE-2024-6868 Arbitrary File Write in mudler/LocalAI

mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction. When model configurations specify additional files as archives e.g., .tar, these archives are automatically extracted after downloading. This behavior can be exploited to perfor...

PT-2024-38028 · Unknown · Mudler/Localai

Name of the Vulnerable Software and Affected Versions: mudler/localai version 2.17.1 Description: The issue is a Timing Attack, a type of side-channel attack that allows an attacker to compromise the cryptosystem by analyzing the time taken to execute cryptographic algorithms. In the context of...

LocalAI 信息泄露漏洞

LocalAI is a free, open source alternative to OpenAI from the individual developer Ettore Di Giacinto. An information disclosure vulnerability exists in LocalAI version 2.17.1, which stems from vulnerability to timing attacks that allow an attacker to compromise a cryptosystem by analyzing the ti...

LocalAI 安全漏洞

LocalAI is a free, open source alternative to OpenAI from the individual developer Ettore Di Giacinto. A security vulnerability exists in LocalAI version 2.17.1, which stems from mishandling of automatic archive extraction, allowing arbitrary file writes that could lead to remote code execution R...

PT-2024-37915 · Unknown · Mudler/Localai

Name of the Vulnerable Software and Affected Versions: mudler/LocalAI version 2.17.1 Description: The issue arises from improper handling of automatic archive extraction in model configurations. When archives e.g., .tar are specified, they are automatically extracted after downloading, potentiall...

CVE-2024-7010: Observable Timing Discrepancy

mudler/localai version 2.17.1 is vulnerable to a Timing Attack. This type of side-channel attack allows an attacker to compromise the cryptosystem by analyzing the time taken to execute cryptographic algorithms. Specifically, in the context of password handling, an attacker can determine valid...

CVE-2024-6868: Improper Link Resolution Before File Access

mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive extraction. When model configurations specify additional files as archives e.g., .tar, these archives are automatically extracted after downloading. This behavior can be exploited to perfor...

CVE-2024-6983

creationtimestamp| type| source ---|---|--- 2024-09-27 19:14:37+00:00| seen| https://t.me/cvedetector/6549 2025-02-18 12:07:35+00:00| published-proof-of-concept| https://github.com/google/tsunami-security-scanner-plugins/tree/master/community/detectors/mudlerlocalaicve20246983 2026-07-25...

CVE-2024-6983

mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the configuration file but also from other inputs, allowing an attacker to upload a binary file and execute malicious code. This can lead to the...

CVE-2024-6983 Remote Code Execution in mudler/localai

mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the configuration file but also from other inputs, allowing an attacker to upload a binary file and execute malicious code. This can lead to the...

CVE-2024-6983 Remote Code Execution in mudler/localai

mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the configuration file but also from other inputs, allowing an attacker to upload a binary file and execute malicious code. This can lead to the...

CVE-2024-6983

CVE-2024-6983 affects mudler/localai v2.17.1. The backend accepts inputs beyond the configuration file, enabling an attacker to upload a binary and execute code, potentially gaining full system control. Public reports in connected sources confirm this RCE vector and cite the vulnerable version as...

CVE-2024-6983 Remote Code Execution in mudler/localai

mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the configuration file but also from other inputs, allowing an attacker to upload a binary file and execute malicious code. This can lead to the...

CVE-2024-6983: Improper Control of Generation of Code

mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the configuration file but also from other inputs, allowing an attacker to upload a binary file and execute malicious code. This can lead to the...

LocalAI 代码注入漏洞

LocalAI is a free, open source alternative to OpenAI from the individual developer Ettore Di Giacinto. A code injection vulnerability exists in LocalAI version 2.17.1, which originates when the localai backend receives input not only from a configuration file, but also from other inputs, allowing...

PT-2024-38020 · Localai · Localai

Name of the Vulnerable Software and Affected Versions: mudler/localai version 2.17.1 Description: The localai backend is susceptible to remote code execution. This occurs because the backend accepts inputs from sources beyond the configuration file, enabling an attacker to upload and execute a...

Server-Side Request Forgery

github.com/go-skynet/localai is vulnerable to Server-Side Request Forgery. The vulnerability is due to the /models/apply endpoint supporting both https:// and file:// schemes, which can lead to LFI. The attacker can exploit this vulnerability with network access to the LocalAI instance, potential...

CVE-2024-6095

A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery SSRF and partial Local File Inclusion LFI. The endpoint supports both https:// and file:// schemes, where the latter can lead to LFI. However, the output is limited due to the...

CVE-2024-6095

Vulnerability: LocalAI (mudler/localai) 2.15.0 has a SSRF and partial LFI in the /models/apply endpoint. The endpoint accepts both http(s):// and file:// schemes, with file:// enabling local-file access. Impact is described as potential unauthorized access to internal HTTP(S) services and partial...