Vulnerability GO-2025-3542
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
1 year ago
March 25, 2025 at 07:38 PM UTC
LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality in github.com/mudler/LocalAI
v0.8.1 - v1.40.0
v0.8.1 - v1.40.0
Summary
LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality in github.com/mudler/LocalAI
Details
LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality in github.com/mudler/LocalAI.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/mudler/LocalAI before v2.22.0.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
2 months ago
LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs
v0.8.1 - v1.40.0 GHSA-8c5q-hx4g-qq23
v0.8.1 - v1.40.0 GHSA-8c5q-hx4g-qq23
Medium Risk
1 year ago
LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality
v0.8.1 - v1.40.0 GHSA-w6hh-w36c-vxmw
v0.8.1 - v1.40.0 GHSA-w6hh-w36c-vxmw
Unknown
1 year ago
LocalAI Cross-site Scripting vulnerability in github.com/mudler/LocalAI
v0.8.1 - v1.40.0 GO-2024-3253
v0.8.1 - v1.40.0 GO-2024-3253
Medium Risk
1 year ago
LocalAI Cross-site Scripting vulnerability
v0.8.1 - v1.40.0 GHSA-ghx4-cgxw-7h9p
v0.8.1 - v1.40.0 GHSA-ghx4-cgxw-7h9p
Impacted packages
Timeline
Published
1 year ago
March 25, 2025 at 07:38 PM UTC
Last Modified
1 year ago
March 25, 2025 at 08:22 PM UTC