Vulnerability GHSA-w6hh-w36c-vxmw
Medium Risk
MEDIUM RISK
CVSS Score: 5.4
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
1 year ago
March 20, 2025 at 12:32 PM UTC
LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality
v0.8.1 - v1.40.0
v0.8.1 - v1.40.0
Summary
LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality
Details
mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts in the context of the victim's browser, potentially compromising user sessions, stealing session cookies, redirecting users to malicious websites, or manipulating the DOM.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
2 months ago
LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs
v0.8.1 - v1.40.0 GHSA-8c5q-hx4g-qq23
v0.8.1 - v1.40.0 GHSA-8c5q-hx4g-qq23
Unknown
1 year ago
LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality in github.com/mudler/LocalAI
v0.8.1 - v1.40.0 GO-2025-3542
v0.8.1 - v1.40.0 GO-2025-3542
Unknown
1 year ago
LocalAI Cross-site Scripting vulnerability in github.com/mudler/LocalAI
v0.8.1 - v1.40.0 GO-2024-3253
v0.8.1 - v1.40.0 GO-2024-3253
Medium Risk
1 year ago
LocalAI Cross-site Scripting vulnerability
v0.8.1 - v1.40.0 GHSA-ghx4-cgxw-7h9p
v0.8.1 - v1.40.0 GHSA-ghx4-cgxw-7h9p
Impacted packages
Timeline
Published
1 year ago
March 20, 2025 at 12:32 PM UTC
Last Modified
1 year ago
March 25, 2025 at 08:22 PM UTC