LocalAI vulnerabilities

CVEs whose affected-version data names the LocalAI package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-59707High· 8.6PoC

2mo ago

LocalAI - Server-Side Request Forgery via POST /models/apply

LocalAI contains an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint that allows attackers to fetch arbitrary internal URLs. The endpoint passes unsanitized gallery URL fields directly to galle…

▾ MidnightLocalAI · LocalAIEPSS 0.48%via CVEORG