CVE-2024-2029: fallo crítico en mudler/localai
Command Injection in mudler/localai
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.8epss 2.9%
A command injection vulnerability exists in the `TranscriptEndpoint` of mudler/localai, specifically within the `audioToWav` function used for converting audio files to WAV format for transcription. The vulnerability arises due to the lack of sanitization of user-supplied filenames before passing them to ffmpeg via a shell command, allowing an attacker to execute arbitrary commands on the host system. Successful exploitation could lead to unauthorized access, data breaches, or other detrimental impacts, depending on the privileges of the process executing the code.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Productos afectados
mudler · mudler/localaiCVEs relacionadas — mudler/localai
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-5182HIGHPath Traversal in mudler/localaiEPSS 25.5%CVE-2024-5181CRITICALCommand Injection in mudler/localaiEPSS 2.7%CVE-2024-6095MEDIUMSSRF and Partial LFI in /models/apply Endpoint in mudler/localaiEPSS 2.6%CVE-2024-6868HIGHArbitrary File Write in mudler/LocalAIEPSS 1.5%CVE-2024-6983HIGHRemote Code Execution in mudler/localaiEPSS 1.3%CVE-2024-9900MEDIUMCross-Site Scripting (XSS) in mudler/localaiEPSS 0.5%