{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-23T14:52:23.428","vulnerabilities":[{"cve":{"id":"CVE-2024-9900","sourceIdentifier":"security@huntr.dev","published":"2025-03-20T10:15:50.417","lastModified":"2026-06-17T08:25:28.040","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts in the context of the victim's browser, potentially compromising user sessions, stealing session cookies, redirecting users to malicious websites, or manipulating the DOM."},{"lang":"es","value":"La versión 2.21.1 de mudler/localai contiene una vulnerabilidad de Cross-Site Scripting (XSS) en su función de búsqueda. Esta vulnerabilidad surge debido a una depuración inadecuada de la entrada del usuario, lo que permite la inyección y ejecución de código JavaScript arbitrario. Esto puede provocar la ejecución de scripts maliciosos en el navegador de la víctima, lo que podría comprometer las sesiones del usuario, robar cookies de sesión, redirigir a los usuarios a sitios web maliciosos o manipular el DOM."}],"affected":[{"source":"security@huntr.dev","affectedData":[{"vendor":"mudler","product":"mudler/localai","versions":[{"version":"unspecified","lessThan":"2.22.0","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV30":[{"source":"security@huntr.dev","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-03-20T13:49:07.441013Z","id":"CVE-2024-9900","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@huntr.dev","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mudler:localai:2.21.1:*:*:*:*:*:*:*","matchCriteriaId":"A584258D-3530-4396-B7C8-A3EC4E8CD1C3"}]}]}],"references":[{"url":"https://github.com/mudler/localai/commit/a1634b219a4e52813e70ff07e6376a01449c4515","source":"security@huntr.dev","tags":["Patch"]},{"url":"https://huntr.com/bounties/b39cd230-db66-471b-89b9-24afaa078e68","source":"security@huntr.dev","tags":["Exploit","Third Party Advisory"]},{"url":"https://huntr.com/bounties/b39cd230-db66-471b-89b9-24afaa078e68","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Third Party Advisory"]}]}}]}