Cross-Site Request Forgery (CSRF) Vulnerability in mudler/localai

published 2024-04-01 2 y ago modified 2026-06-17 4 mo ago also GHSA-jhvf-7c85-3c9g , GO-2024-2705 , EUVD-2024-1234

cvss: 6.5; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 24%
public exploits: 0; none known

A Cross-Site Request Forgery (CSRF) vulnerability exists in the mudler/localai application, allowing attackers to craft malicious webpages that, when visited by a victim, perform unauthorized actions on the victim's local LocalAI instance without their consent. This vulnerability enables attackers to exhaust system resources, consume credits, and fill disk space by making numerous resource-intensive API calls, such as generating images or uploading files. The vulnerability stems from the application's acceptance of simple request content-types without requiring CSRF tokens or implementing other CSRF mitigation measures. Successful exploitation does not require network access to the vulnerable LocalAI environment.

Patch / fix

fixed in 1

mudler localai 2.17.0

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-07-17)

Exploit prediction

0.31% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

huntr.com https://huntr.com/bounties/7afdc4d3-4b68-45ea-96d0-cf9ed3712ae8 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.0	6.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
GitHub	3.0	6.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
go	github.com/go-skynet/LocalAI	<=2.7.0 all versions	no fix listed

Affected products

mudler mudler/localai
mudler localai

Classification

Weakness

CWE-352 Cross-Site Request Forgery

References

huntr.com /bounties/7afdc4d3-4b68-45ea-96d0-cf9ed3712ae8
web, exploit, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2024-3135
advisory
github.com /mudler/LocalAI
package
github.com /advisories/GHSA-jhvf-7c85-3c9g
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary