CVE-2024-5616

CVE-2024-5616 affects mudler/LocalAI up to version 2.15.0, where the model deletion functionality is vulnerable to CSRF due to insufficient protection. An attacker could lure a user to delete an installed model (e.g., gpt-4-vision-preview) by visiting a malicious page. Affected component: model d...

CVE-2024-5616 CSRF Vulnerability in mudler/LocalAI

A Cross-Site Request Forgery CSRF vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a model, such as 'gpt-4-vision-preview',...

PT-2024-37382 · Unknown · Mudler/Localai

Name of the Vulnerable Software and Affected Versions: mudler/localai versions 2.15.0 Description: A vulnerability in the "/models/apply" endpoint allows for Server-Side Request Forgery SSRF and partial Local File Inclusion LFI. The endpoint supports both https:// and file:// schemes, where the...

PT-2024-36727 · Mudler · Localai

Name of the Vulnerable Software and Affected Versions: mudler/LocalAI versions up to and including 2.15.0 Description: A Cross-Site Request Forgery CSRF vulnerability exists, allowing attackers to trick victims into deleting installed models by crafting a malicious HTML page. This can cause the...

LocalAI Security Breach

LocalAI is a free, open source alternative to OpenAI from the individual developer Ettore Di Giacinto. A security vulnerability exists in LocalAI version 2.15.0 and prior versions that stems from the presence of a Cross Site Request Forgery CSRF vulnerability. An attacker could use this...

LocalAI Code Issues Vulnerabilities

LocalAI is a free, open source alternative to OpenAI from the individual developer Ettore Di Giacinto. A code issue vulnerability exists in LocalAI version 2.15.0, which stems from a cross-site request forgery and local file inclusion vulnerability in the /models/apply API...

GO-2024-2938 LocalAI path traversal vulnerability in github.com/go-skynet/LocalAI

LocalAI path traversal vulnerability in github.com/go-skynet/LocalAI. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please suggest...

CVE-2024-5181

A command injection vulnerability exists in the mudler/localai version 2.14.0. The vulnerability arises from the application's handling of the backend parameter in the configuration file, which is used in the name of the initialized process. An attacker can exploit this vulnerability by...

CVE-2024-5181

CVE-2024-5181 – mudler/localai (v2.14.0) : A command injection flaw arises from how the backend parameter in the configuration file is used to name the initialized process, enabling an attacker to manipulate the path of the vulnerable binary and execute arbitrary code. The issue stems from improp...

CVE-2024-5181 Command Injection in mudler/localai

A command injection vulnerability exists in the mudler/localai version 2.14.0. The vulnerability arises from the application's handling of the backend parameter in the configuration file, which is used in the name of the initialized process. An attacker can exploit this vulnerability by...

CVE-2024-5181 Command Injection in mudler/localai

A command injection vulnerability exists in the mudler/localai version 2.14.0. The vulnerability arises from the application's handling of the backend parameter in the configuration file, which is used in the name of the initialized process. An attacker can exploit this vulnerability by...

CVE-2024-5181 Command Injection in mudler/localai

A command injection vulnerability exists in the mudler/localai version 2.14.0. The vulnerability arises from the application's handling of the backend parameter in the configuration file, which is used in the name of the initialized process. An attacker can exploit this vulnerability by...

LocalAI Operating System Command Injection Vulnerability

LocalAI is a free, open source alternative to OpenAI from the individual developer Ettore Di Giacinto. An OS command injection vulnerability exists in localai version 2.14.0, which stems from improper neutralization of special elements used in OS commands, allowing an attacker to execute arbitrar...

LocalAI path traversal vulnerability

A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the model parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated model parameter, an attacker can traverse the directory...

GHSA-CPCX-R2GQ-X893 LocalAI path traversal vulnerability

A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the model parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated model parameter, an attacker can traverse the directory...

CVE-2024-5182

A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the model parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated model parameter, an attacker can traverse the directory...

CVE-2024-5182

CVE-2024-5182 describes a path traversal vulnerability in mudler/localai 2.14.0 where an attacker can exploit the manipulated, input-validated model parameter during the model deletion process to delete arbitrary files. The issue arises from insufficient input validation and sanitization of the m...

CVE-2024-5182 Path Traversal in mudler/localai

A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the model parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated model parameter, an attacker can traverse the directory...

CVE-2024-5182 Path Traversal in mudler/localai

A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the model parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated model parameter, an attacker can traverse the directory...

CVE-2024-5182 Path Traversal in mudler/localai

A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the model parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated model parameter, an attacker can traverse the directory...