{"cve":"CVE-2024-9900","nvd":{"published":"2025-03-20T10:15:50.417","modified":"2026-06-17T08:25:28.040","status":"Modified","description":"mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts in the context of the victim's browser, potentially compromising user sessions, stealing session cookies, redirecting users to malicious websites, or manipulating the DOM.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79"],"references":["https://github.com/mudler/localai/commit/a1634b219a4e52813e70ff07e6376a01449c4515","https://huntr.com/bounties/b39cd230-db66-471b-89b9-24afaa078e68","https://huntr.com/bounties/b39cd230-db66-471b-89b9-24afaa078e68"],"products":["mudler:localai"],"source":"nvd","synced_at":"2026-10-19T22:00:28.034033815+00:00"},"epss":{"cve":"CVE-2024-9900","score":0.00536,"percentile":0.45232,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-w6hh-w36c-vxmw","url":"https://osv.dev/vulnerability/GHSA-w6hh-w36c-vxmw","summary":"LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality","modified":"2025-03-25T20:22:02.028631Z","packages":[{"ecosystem":"Go","name":"github.com/mudler/LocalAI","purl":"pkg:golang/github.com/mudler/LocalAI","ranges":["<2.22.0"],"fixed":["2.22.0"]}]},{"id":"GO-2025-3542","url":"https://osv.dev/vulnerability/GO-2025-3542","summary":"LocalAI Cross-Site Scripting (XSS) vulnerability in its search functionality in github.com/mudler/LocalAI","modified":"2025-03-25T20:22:02.028631Z","packages":[{"ecosystem":"Go","name":"github.com/mudler/LocalAI","purl":"pkg:golang/github.com/mudler/LocalAI","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}