CVE-2024-2029
Description
A command injection vulnerability exists in the `TranscriptEndpoint` of mudler/localai, specifically within the `audioToWav` function used for converting audio files to WAV format for transcription. The vulnerability arises due to the lack of sanitization of user-supplied filenames before passing them to ffmpeg via a shell command, allowing an attacker to execute arbitrary commands on the host system. Successful exploitation could lead to unauthorized access, data breaches, or other detrimental impacts, depending on the privileges of the process executing the code.
How to fix
- mudler localai2.10.0 or later
- github.com/go-skynet/LocalAI2.10.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mudler localai | v < 2.10.0 | 2.10.0 |
| github.com/go-skynet/LocalAIGo | v < 2.10.0, No range specified | 2.10.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.