Vulnetix
Try Vulnetix Request Demo
CVE-2024-9900 PUBLISHED CVSS 5.400000095367432 MEDIUM

mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts in the context of the victim's browser, potentially compromising user sessions, stealing session cookies, redirecting users to malicious websites, or manipulating the DOM.

EPSS 0.12% · 30.6th percentile

Risk Scores

CVSS v3.0
5.400000095367432
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS Score
0.12%
30.6th percentile

Affected Products

VendorProductVersions
mudlermudler/localaiunspecified, unspecified
github.commudler/LocalAI0, 0
mudlerlocalai2.21.1, 2.21.1

Timeline

References

Open in Interactive Console →