CVE-2024-9900

mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts in the context of the victim's browser, potentially compromising user sessions, stealing session cookies, redirecting users to malicious websites, or manipulating the DOM.

• CWE-79
• CWE-79

• https://github.com/mudler/localai/commit/a1634b219a4e52813e70ff07e6376a01449c4515Patch
• https://huntr.com/bounties/b39cd230-db66-471b-89b9-24afaa078e68Exploit, Third Party Advisory
• https://huntr.com/bounties/b39cd230-db66-471b-89b9-24afaa078e68Exploit, Third Party Advisory

Published

Mar 20, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-9894A vulnerability, which was classified as critical, was found…8.8
• CVE-2024-9895The Smart Online Order for Clover plugin for WordPress is vu…5.4
• CVE-2024-9896The BBP Core – Expand bbPress powered forums with useful fea…6.1
• CVE-2024-9897The StreamWeasels Twitch Integration plugin for WordPress is…5.4
• CVE-2024-9898The Parallax Image plugin for WordPress is vulnerable to Sto…5.4
• CVE-2024-9899Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2024-9901Rejected reason: ** REJECT ** DO NOT USE THIS CVE ID NUMBER.…
• CVE-2024-9902A flaw was found in Ansible. The ansible-core `user` module …6.3
• CVE-2024-9903A vulnerability classified as critical has been found in 07F…7.2
• CVE-2024-9904A vulnerability classified as critical was found in 07FLYCMS…7.2
• CVE-2024-9905A vulnerability, which was classified as critical, has been …8.8
• CVE-2024-9906A vulnerability, which was classified as problematic, was fo…5.4