Command Injection Vulnerability in TranscriptEndpoint of mudler/localai

CVE-2024-2029

Summary

A command injection vulnerability has been identified in the TranscriptEndpoint of Mudler's LocalAI platform. The vulnerability specifically lies within the audioToWav function, which is used for converting audio files into WAV format for transcription. The flaw stems from inadequate sanitization of user-provided filenames processed using the ffmpeg command through a shell invocation. This oversight could permit an attacker to execute arbitrary commands on the underlying host system. Should the exploitation be successful, it may lead to unauthorized access, potential data breaches, or various other negative consequences, contingent upon the executed code's privileges.

References