localai vulnerabilities and fixes

Q: How do I fix localai vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Q: Is localai being exploited right now?

None of the tracked localai CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Q: Which localai CVE should I patch first?

CVE-2024-5181 currently ranks highest (69/100): A command injection vulnerability exists in the mudler/localai version 2.14.0.

Recent CVEs affecting localai, with upgrade or downgrade steps. 11 tracked.

localai has 11 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 7. Most recent: 2025-03-20. Highest priority: CVE-2024-5181 (score 69/100).

CVE-2024-9900 MEDIUM 6.1 DOWNGRADE mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality
CVE-2024-7010 MEDIUM 5.9 DOWNGRADE mudler/localai version 2.17.1 is vulnerable to a Timing Attack
CVE-2024-6983 HIGH 8.8 DOWNGRADE mudler/localai version 2.17.1 is vulnerable to remote code execution
CVE-2024-6868 CRITICAL 9.8 DOWNGRADE mudler/LocalAI version 2.17.1 allows for arbitrary file write due to improper handling of automatic archive ex
CVE-2024-6095 MEDIUM 5.8 UPGRADE A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request
CVE-2024-5616 MEDIUM 4.3 UPGRADE A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0
CVE-2024-5182 CRITICAL 9.1 UPGRADE A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `mod
CVE-2024-5181 CRITICAL 9.8 DOWNGRADE A command injection vulnerability exists in the mudler/localai version 2.14.0
CVE-2024-48057 MEDIUM 6.1 UPGRADE localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS)
CVE-2024-3135 MEDIUM 6.5 UPGRADE A Cross-Site Request Forgery (CSRF) vulnerability exists in the mudler/localai application, allowing attackers
CVE-2024-2029 CRITICAL 9.8 UPGRADE A command injection vulnerability exists in the `TranscriptEndpoint` of mudler/localai, specifically within th

FAQ

How do I fix localai vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is localai being exploited right now?

None of the tracked localai CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which localai CVE should I patch first?

CVE-2024-5181 currently ranks highest (69/100): A command injection vulnerability exists in the mudler/localai version 2.14.0.

RSS feed for localai · ← Back to latest CVEs