CVE-2024-9900: Mudler LocalAI XSS Vulnerability

CVE-2024-9900 Overview

CVE-2024-9900 is a Cross-Site Scripting (XSS) vulnerability affecting mudler/localai version 2.21.1. The flaw resides in the application's search functionality, which fails to properly sanitize user-supplied input before rendering it in the browser. An attacker can inject arbitrary JavaScript that executes within the context of a victim's session when the crafted content is viewed.

Successful exploitation allows session cookie theft, DOM manipulation, redirection to attacker-controlled sites, and hijacking of authenticated user sessions. The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's browser session, enabling session hijacking, credential theft, and unauthorized actions against the LocalAI web interface.

Affected Products

mudler LocalAI version 2.21.1
LocalAI deployments exposing the search functionality to untrusted input
Self-hosted LocalAI instances running the vulnerable release

Discovery Timeline

2025-03-20 - CVE-2024-9900 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9900

Vulnerability Analysis

The vulnerability stems from missing output encoding in LocalAI's search feature. User-controlled parameters flow into HTML responses without sanitization, allowing script tags and event handlers to execute in the browser. The reflected nature of the flaw means an attacker delivers a malicious link or content that, when interacted with by a victim, triggers arbitrary JavaScript execution.

Because LocalAI is commonly deployed for local model hosting and inference, an authenticated administrator visiting a crafted URL may unknowingly expose model configurations, API tokens stored in the browser, or leak session state to a remote attacker.

Root Cause

The root cause is the absence of HTML sanitization in the gallery and model list rendering paths. Untrusted string values were embedded directly into HTML output without escaping angle brackets, quotes, or JavaScript URI schemes. This allowed attacker-controlled input to break out of intended text contexts and be interpreted as executable markup.

Attack Vector

The vulnerability is exploited over the network and requires user interaction. An attacker crafts a URL or payload containing JavaScript that targets the search or gallery endpoint. When a victim loads the response in their browser, the injected script executes with the victim's privileges against the LocalAI application.

// Patch: adds bluemonday HTML sanitizer to modelslist.go
 	"io/ioutil"
 	"os"
 
+	"github.com/microcosm-cc/bluemonday"
 	"gopkg.in/yaml.v3"
 )

Source: mudler/localai commit a1634b2

// Patch: adds bluemonday HTML sanitizer to core/http/elements/gallery.go
 	"github.com/chasefleming/elem-go"
 	"github.com/chasefleming/elem-go/attrs"
+	"github.com/microcosm-cc/bluemonday"
 	"github.com/mudler/LocalAI/core/gallery"
 	"github.com/mudler/LocalAI/core/p2p"
 	"github.com/mudler/LocalAI/core/services"

Source: mudler/localai commit a1634b2. The fix imports the bluemonday sanitizer library and applies it broadly across gallery and model list rendering code paths to strip unsafe HTML and JavaScript from user-controlled content.

Detection Methods for CVE-2024-9900

Indicators of Compromise

HTTP requests to LocalAI search or gallery endpoints containing <script>, onerror=, javascript:, or encoded variants in query parameters
Unexpected outbound requests from user browsers to unknown domains after visiting LocalAI pages
Anomalous session cookie access patterns or session reuse from unfamiliar IP addresses
Web server logs showing URL-encoded payloads targeting search query parameters

Detection Strategies

Deploy web application firewall (WAF) rules to identify reflected XSS payloads in query strings and POST bodies
Enable Content Security Policy (CSP) reporting to capture script-src violations originating from LocalAI responses
Correlate reverse proxy logs with browser-side telemetry to identify script execution from injected payloads

Monitoring Recommendations

Log and alert on any request to LocalAI endpoints containing HTML tag characters or JavaScript keywords in parameters
Monitor authentication events for LocalAI administrator accounts, focusing on session anomalies
Review outbound network traffic from hosts accessing LocalAI for connections to newly registered or low-reputation domains

How to Mitigate CVE-2024-9900

Immediate Actions Required

Upgrade LocalAI to the version containing commit a1634b2 or later, which rolls out bluemonday sanitization
Restrict access to the LocalAI web interface using network segmentation, VPN, or authenticated reverse proxy
Instruct administrators to avoid clicking untrusted links referencing internal LocalAI hostnames

Patch Information

The fix is delivered in mudler/localai commit a1634b219a4e52813e70ff07e6376a01449c4515, titled "fix: roll out bluemonday Sanitize more widely (#3794)." The patch integrates the microcosm-cc/bluemonday HTML sanitization library across gallery and model list rendering functions. Additional context is available in the Huntr bug bounty report.

Workarounds

Place LocalAI behind a reverse proxy that enforces a strict Content Security Policy blocking inline scripts
Disable or restrict access to the search and gallery functionality until the patch is applied
Require authentication in front of LocalAI and limit exposure to trusted internal networks only

bash

# Example nginx reverse proxy CSP header to reduce XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;