Moderate severityNVD Advisory· Published Mar 20, 2025· Updated Apr 4, 2025

Cross-Site Scripting (XSS) in mudler/localai

CVE-2024-9900

Description

mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts in the context of the victim's browser, potentially compromising user sessions, stealing session cookies, redirecting users to malicious websites, or manipulating the DOM.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
github.com/mudler/LocalAIGo	< 2.22.0	2.22.0

Affected products

ghsa-coords2 versions
pkg:golang/github.com/mudler/localai pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Tumbleweed
< 2.22.0+ 1 more
- (no CPE)range: < 2.22.0
- (no CPE)range: < 0.0.20250327T184518-1.1
Mudler/Mudler/localaiv5
Range: unspecified

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-w6hh-w36c-vxmwghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-9900ghsaADVISORY
github.com/mudler/localai/commit/a1634b219a4e52813e70ff07e6376a01449c4515ghsaWEB
huntr.com/bounties/b39cd230-db66-471b-89b9-24afaa078e68ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000