CVE-2024-9900

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-9900
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9900.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-9900
Aliases
Downstream
Related
Published
2025-03-20T10:09:14.108Z
Modified
2026-07-08T08:11:54.834231706Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Cross-Site Scripting (XSS) in mudler/localai
Details

mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts in the context of the victim's browser, potentially compromising user sessions, stealing session cookies, redirecting users to malicious websites, or manipulating the DOM.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9900.json",
    "cna_assigner": "@huntr_ai",
    "cwe_ids": [
        "CWE-79"
    ]
}
References

Affected packages

Git / github.com/mudler/localai

Affected ranges

Type
GIT
Repo
https://github.com/mudler/localai
Events
Introduced
33b2d38dd0198d78dbc26aa020acfb6ff4c4048c
Fixed
a1634b219a4e52813e70ff07e6376a01449c4515
Database specific 
{
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:mudler:localai:2.21.1:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.21.1"
        },
        {
            "last_affected": "2.21.1"
        }
    ]
}

Affected versions

2.*
2.21.1
v2.*
v2.21.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9900.json"