CVE-2024-9900

mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts in the context of the victim's browser, potentially compromising user sessions, stealing session cookies, redirecting users to malicious websites, or manipulating the DOM.
Configurations

Configuration 1 (hide)

cpe:2.3:a:mudler:localai:2.21.1:*:*:*:*:*:*:*

History

04 Apr 2025, 09:15

Type Values Removed Values Added
First Time Mudler
Mudler localai
CPE cpe:2.3:a:mudler:localai:2.21.1:*:*:*:*:*:*:*
CWE CWE-115 CWE-79
CVSS v2 : unknown
v3 : 5.4
v2 : unknown
v3 : 6.1
References () https://github.com/mudler/localai/commit/a1634b219a4e52813e70ff07e6376a01449c4515 - () https://github.com/mudler/localai/commit/a1634b219a4e52813e70ff07e6376a01449c4515 - Patch
References () https://huntr.com/bounties/b39cd230-db66-471b-89b9-24afaa078e68 - () https://huntr.com/bounties/b39cd230-db66-471b-89b9-24afaa078e68 - Exploit, Third Party Advisory

20 Mar 2025, 14:15

Type Values Removed Values Added
References () https://huntr.com/bounties/b39cd230-db66-471b-89b9-24afaa078e68 - () https://huntr.com/bounties/b39cd230-db66-471b-89b9-24afaa078e68 -
Summary
  • (es) La versión 2.21.1 de mudler/localai contiene una vulnerabilidad de Cross-Site Scripting (XSS) en su función de búsqueda. Esta vulnerabilidad surge debido a una depuración inadecuada de la entrada del usuario, lo que permite la inyección y ejecución de código JavaScript arbitrario. Esto puede provocar la ejecución de scripts maliciosos en el navegador de la víctima, lo que podría comprometer las sesiones del usuario, robar cookies de sesión, redirigir a los usuarios a sitios web maliciosos o manipular el DOM.

20 Mar 2025, 10:15

Type Values Removed Values Added
New CVE

Information

Published : 2025-03-20 10:15

Updated : 2025-04-04 09:15


NVD link : CVE-2024-9900

Mitre link : CVE-2024-9900

CVE.ORG link : CVE-2024-9900


JSON object : View

Products Affected

mudler

  • localai
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')