{"cve":"CVE-2024-48057","nvd":{"published":"2024-11-04T23:15:04.393","modified":"2026-06-17T07:58:10.033","status":"Analyzed","description":"localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS). When calling the delete model API and passing inappropriate parameters, it can cause a one-time storage XSS, which will trigger the payload when a user accesses the homepage.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79","CWE-352"],"references":["https://gist.github.com/AfterSnows/1bd7ee5a3a42dbb5f5ff67f7f9c8ccec","https://rumbling-slice-eb0.notion.site/LocalAI-deleted-model-with-storage-XSS-CSRF-vulnerability-in-mudler-localai-101e3cda9e8c80e0ac12fe418d5dd982?pvs=4"],"products":["mudler:localai"],"source":"nvd","synced_at":"2026-10-19T21:57:07.693694550+00:00"},"epss":{"cve":"CVE-2024-48057","score":0.00235,"percentile":0.14442,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-ghx4-cgxw-7h9p","url":"https://osv.dev/vulnerability/GHSA-ghx4-cgxw-7h9p","summary":"LocalAI Cross-site Scripting vulnerability","modified":"2025-03-20T23:22:35Z","packages":[{"ecosystem":"Go","name":"github.com/mudler/LocalAI","purl":"pkg:golang/github.com/mudler/LocalAI","ranges":["<=2.20.1"],"fixed":[]}]},{"id":"GO-2024-3253","url":"https://osv.dev/vulnerability/GO-2024-3253","summary":"LocalAI Cross-site Scripting vulnerability in github.com/mudler/LocalAI","modified":"2026-03-03T04:56:00.109784Z","packages":[{"ecosystem":"Go","name":"github.com/mudler/LocalAI","purl":"pkg:golang/github.com/mudler/LocalAI","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}