Vulnerability · Published Sep 27, 2024 · Assigned by @huntr_ai
CVE-2024-6983Remote Code Execution in mudler/localai
High 8.8
In plain English
A high-severity code injection in mudler/localai from mudler. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).
Severity (CVSS 3.0)8.8High
Exploit odds (30 days)1.3%top 29.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the configuration file but also from other inputs, allowing an attacker to upload a binary file and execute malicious code. This can lead to the attacker gaining full control over the system.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| mudler | mudler/localai | unspecified – before 2.19.4 |
Weakness: CWE-94 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H