CVE-2024-6983

Published: Sep 27, 2024Modified: Jul 10, 2025

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: security@huntr.dev (Secondary)

Description

mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the configuration file but also from other inputs, allowing an attacker to upload a binary file and execute malicious code. This can lead to the attacker gaining full control over the system.

Affected (1)

Products: Mudler: Localai

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mudler Localai	Version 2.17.1

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

https://github.com/mudler/localai/commit/d02a0f6f01d5c4a926a2d67190cb55d7aca23b66

Source: security@huntr.dev

Patch

https://huntr.com/bounties/f91fb287-412e-4c89-87df-9e4b6e609647

Source: security@huntr.dev

ExploitThird Party Advisory

Timeline

No history available yet.