CVE-2024-9900 — Vulnetix

CVE-2024-9900 PUBLISHED CVSS 5.400000095367432 MEDIUM

mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts in the context of the victim's browser, potentially compromising user sessions, stealing session cookies, redirecting users to malicious websites, or manipulating the DOM.

EPSS 0.23% · 45.8th percentile

Risk Scores

CVSS 3.0

5.400000095367432

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS Score

0.23%

45.8th percentile

Affected Products

Vendor	Product	Versions
mudler	mudler/localai	unspecified, unspecified
github.com	mudler/LocalAI	0, 0
mudler	localai	2.21.1, 2.21.1

Exploit Intelligence

CIRCL published-proof-of-concept: CVE-2024-9900 (circl-sighting)
https://github.com/mudler/localai/commit/a1634b219a4e52813e70ff07e6376a01449c4515 (circl)
https://huntr.com/bounties/b39cd230-db66-471b-89b9-24afaa078e68 (cve.org)

Timeline

Mar 20, 2025 CVE Published
Mar 20, 2025 EPSS Score
Mar 21, 2025 CVE Updated
Mar 21, 2025 Coalition ESS Score
Apr 2, 2025 EPSS Score
Apr 4, 2025 PoC Published
Apr 16, 2025 EPSS Score
Apr 29, 2025 EPSS Score
May 4, 2025 Coalition ESS Score
May 12, 2025 EPSS Score
May 26, 2025 EPSS Score
Jun 6, 2025 Coalition ESS Score

References

Open in Interactive Console →