Command Injection Vulnerability in mudler/localai 2.14.0

CVE-2024-5181

What is CVE-2024-5181?

A command injection vulnerability exists in Mudler's LocalAI version 2.14.0, stemming from inadequate handling of the backend parameter within its configuration file. This flaw permits an adversary to manipulate the path of the vulnerable binary specified in the backend parameter, paving the way for arbitrary code execution on the target system. By exploiting this vulnerability, attackers can gain potentially full control over affected systems, underscoring the critical need for prompt remediation and enhanced security measures.

News Articles

prophaze.com

CVE-2024-5181

CVE-2024-5181 : MUDLER LOCALAI UP TO 2.14.0 CONFIGURATION FILE BACKEND OS COMMAND INJECTION - Cloud WAF

CVE-2024-5181 : A command injection vulnerability exists in the mudler/localai version 2.14.0.

References