Local AI Vulnerable to Cross Site Scripting Attack
CVE-2024-48057

6.1MEDIUM

Key Information:

Vendor

localai

Vendor
CVE Published:
4 November 2024

What is CVE-2024-48057?

localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS). When calling the delete model API and passing inappropriate parameters, it can cause a one-time storage XSS, which will trigger the payload when a user accesses the homepage.

References

https://rumbling-slice-eb0.notion.site/LocalAI-deleted-mo...
https://gist.github.com/AfterSnows/1bd7ee5a3a42dbb5f5ff67...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.