CVE-2024-2029

Katalog CVE

CVSS 9.8 · Critical EPSS 2,9%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada mudler localai. Skor CVSS 3.0 9.8 (Critical) menurut huntr.dev.

Deskripsi (NVD)

A command injection vulnerability exists in the `TranscriptEndpoint` of mudler/localai, specifically within the `audioToWav` function used for converting audio files to WAV format for transcription. The vulnerability arises due to the lack of sanitization of user-supplied filenames before passing them to ffmpeg via a shell command, allowing an attacker to execute arbitrary commands on the host system. Successful exploitation could lead to unauthorized access, data breaches, or other detrimental impacts, depending on the privileges of the process executing the code.

Rincian

Terbit di NVD

10 April 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.0

9.8 (Critical), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

2,9% peluang dieksploitasi; lebih tinggi dari 86,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mudler/localai/commit/31a4c9c9d3abc58de2bdc5305419181c8b33eb1c patch
• https://huntr.com/bounties/e092528a-ce3b-4e66-9b98-3f56d6b276b0 exploit · advisory pihak ketiga