CVE-2024-5616 | BDVDB-2026-241571 Detail

Description#

A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a model, such as 'gpt-4-vision-preview', without the victim's consent. The vulnerability is due to insufficient CSRF protection mechanisms on the model deletion functionality.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12024-07-06Record published in the CVE List.
2. Version 22024-08-01Most recent update recorded in the CVE List.