CVE-2024-3135

CVE-2024-3135 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the mudler/localai application. Attackers can exploit this by crafting malicious webpages that trick a victim's browser into performing unauthorized actions on their local LocalAI instance. This medium-severity vulnerability (CVSS 6.5) allows for resource exhaustion, credit consumption, and disk space filling through unauthenticated, resource-intensive API calls. While no active exploitation, public exploit code, or significant community discussion has been observed, the lack of CSRF tokens makes exploitation relatively straightforward, requiring only user interaction.