CVE-2024-48057

Summary

CVE-2024-48057 is a newly disclosed vulnerability affecting localai versions prior to 2.20.1. This issue allows an attacker to execute Cross-Site Scripting (XSS) attacks by passing inappropriate parameters when calling the delete model API. Consequentially, a one-time storage XSS vulnerability is triggered, posing a risk for payload execution. When a user visits the homepage, the malicious script is activated, potentially compromising the user's session or stealing sensitive information. This vulnerability underscores the importance of timely updates and input validation to prevent XSS attacks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.