Approved changes feed: RSS · Atom
cpe:2.3:a:localai:localai:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Localai (08862d57-7456-56df-8c35-dad3dfdb87fd) |
|---|---|
| Product | Localai (2bfe4534-bb4f-5eea-9171-b05d3e86a941) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-114493 |
vulnerable | 2026-11-03 10:15:53.601873 |
LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects
HIGH (8.6)
LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.
Published: 2026-10-21T17:54:17.584Z
Updated: 2026-10-21T19:50:15.052Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-59707 |
vulnerable | 2026-07-29 01:03:17.541874 |
LocalAI - Server-Side Request Forgery via POST /models/apply
HIGH (8.6)
LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to gallery.GetGalleryConfigFromURLWithContext without proper validation, enabling attackers to force the server to issue HTTP GET requests to private and loopback ranges with partial response content leaked through error messages.
Published: 2026-07-07T20:37:53.194Z
Updated: 2026-09-24T14:18:02.507Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.