PT-2024-38020 · Localai · Localai

Published 2024-09-27 · Updated 2025-07-10 · CVE-2024-6983

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions mudler/localai version 2.17.1

Description The issue arises because the localai backend receives inputs not only from the configuration file but also from other inputs, allowing an attacker to upload a binary file and execute malicious code. This can lead to the attacker gaining full control over the system. The vulnerability is being actively exploited.

Recommendations For mudler/localai version 2.17.1, update to version 2.17.2 to patch the remote code execution vulnerability in the localai backend, preventing attackers from executing malicious code and gaining system control.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-6983

Affected Products

Localai

References · 11

• 🔥 https://huntr.com/bounties/f91fb287-412e-4c89-87df-9e4b6e609647 · Exploit
• https://github.com/mudler/localai/commit/d02a0f6f01d5c4a926a2d67190cb55d7aca23b66 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-6983 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6983 · Vendor Advisory
• https://twitter.com/transilienceai/status/1855661444576281087 · Twitter Post
• https://t.me/cvedetector/6549 · Telegram Post
• https://twitter.com/CveFindCom/status/1839696799868527099 · Twitter Post
• https://t.me/cvenotify/128458 · Telegram Post
• https://twitter.com/transilienceai/status/1854936057101664699 · Twitter Post
• https://t.me/zerodayalert/370 · Telegram Post
• https://twitter.com/CVEnew/status/1839694380401127815 · Twitter Post