CVE-2024-6983

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-6983

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6983.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-6983

Published

2024-09-27T15:43:51Z

Modified

2026-08-12T03:51:37Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Remote Code Execution in mudler/localai

Details

mudler/localai version 2.17.1 is vulnerable to remote code execution. The vulnerability arises because the localai backend receives inputs not only from the configuration file but also from other inputs, allowing an attacker to upload a binary file and execute malicious code. This can lead to the attacker gaining full control over the system.

Database specific

{
    "cna_assigner": "@huntr_ai",
    "cwe_ids": [
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6983.json"
}

References

Affected packages

Git / github.com/mudler/localai

Affected ranges

Type

GIT

Repo

https://github.com/mudler/localai

Events

Introduced

8142bdc48f3619eddc6344fa4ed83b331f7b37c2

Fixed

d02a0f6f01d5c4a926a2d67190cb55d7aca23b66

Database specific

Show details

{
    "cpe": "cpe:2.3:a:mudler:localai:2.17.1:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.17.1"
        },
        {
            "last_affected": "2.17.1"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ]
}

Affected versions

2.*

2.17.1

v2.*

v2.17.1

v2.18.0

v2.18.1

v2.19.0

v2.19.1

v2.19.2

v2.19.3

v2.19.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6983.json"