CVE-2024-48057: localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS). When calling the delete model API and passing inappropriate parameters, it can cause a one-time…

PriorityP424medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.19%

9.0th percentile

localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS). When calling the delete model API and passing inappropriate parameters, it can cause a one-time storage XSS, which will trigger the payload when a user accesses the homepage.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
github.com	mudler_localai	0 – 2.20.1	—
mudler	localai	<= 2.20.1	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.