repository icon
mudler / localai Project repository

:robot: The free, Open Source alternative to OpenAI, Claude and others. Self-hosted and local-first. Drop-in replacement for OpenAI, running on consumer-grade hardware. No GPU required. Runs gguf, transformers, diffusers and many more models architectures. Features: Generate Text, Audio, Video, Images, Voice Cloning, Distributed, P2P inference

Submit a report

FIRST INTERACTION

WITHIN16 DAYS

REVIEW

WITHIN24 DAYS

FIX

WITHIN72 DAYS

There is SSRF in LocalAI's API endpoint `/v1/images/generations`
f01ivor4
pending
Cross-Site Scripting (XSS)
sharmaraghs
Medium
•$75•CVE-2024-9900
CSRF lead to install models
testtttpv1
duplicate
Medium
There is a CSRF vulnerability in the chat page of LocalAI
hexian2001
self closed
LocalAI deleted model with storage XSS&CSRF vulnerability
hexian2001
Low
•$15•CVE-2024-9901
Stored XSS in chat
fpdh0104
self closed
Timing Attack
mvlttt
High
•$450•CVE-2024-7010
Remote Code Execution
mvlttt
High
•$450•CVE-2024-6983
arbitrary file write by abusing automatic archive extraction
ozelis
High
•$450•CVE-2024-6868
Code injection
h2oa
self closed
SSRF and partial LFI in the /models/apply endpoint
sev-hack
Medium
•$75•CVE-2024-6095
CSRF lead to delete installed models
h2oa
Medium
•$75•CVE-2024-5616
Denial of Service
mvlttt
self closed
Path Traversal
mvlttt
High
•$450•CVE-2024-5182
Command Injection
mvlttt
Critical
•$900•CVE-2024-5181
Do not use weak cryptographic hashes in security-critical contexts as data inte...
anonaninda
not applicable
Line 17 in transcript.go calls CombinedOutput() with a command built from untrus...
anonaninda
informative
High
Command injection in audioToWav in mudler/localai
ouxs-19
Critical
•$900•CVE-2024-2029
Attacker can enumerate what files exist on the target system
pinkdraconian
informative
Medium
Cross-Site Request Forgery On All API Calls Leads to Resource, Credit & Disk Spa...
pinkdraconian
Medium
•$75•CVE-2024-3135