GHSA-8c5q-hx4g-qq23

Source

https://github.com/advisories/GHSA-8c5q-hx4g-qq23

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-8c5q-hx4g-qq23/GHSA-8c5q-hx4g-qq23.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8c5q-hx4g-qq23

Aliases

CVE-2026-59707

Published

2026-07-07T21:31:36Z

Modified

2026-10-02T19:30:06Z

Severity

8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator

Summary

LocalAI POST /models/apply permits unauthenticated server-side request forgery through gallery URLs

Details

LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFromURLWithContext without proper validation, enabling attackers to force the server to issue HTTP GET requests to private and loopback ranges with partial response content leaked through error messages.

Database specific

{
    "cwe_ids":  [
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-02T19:14:44Z",
    "nvd_published_at":  "2026-07-07T21:17:29Z",
    "severity":  "CRITICAL"
}

References

Affected packages

Go / github.com/mudler/LocalAI

Package

Name: github.com/mudler/LocalAI; View open source insights on deps.dev
Purl: pkg:golang/github.com/mudler/LocalAI

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.40.1-0.20260703213242-2cbb3c96b34d

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-8c5q-hx4g-qq23/GHSA-8c5q-hx4g-qq23.json"