Threats affecting pkg:golang/LocalAI

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.2	EPSS 0.4%	CVE-2026-114493LocalAI · Server-Side Request Forgery (SSRF) Critical9.2EPSS 0.4%2026-10-21CVE Database V5CVE-2026-114493 LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content. EPSS 0.4%Vulnerability	CVE Database V5	2026-10-21

Page 1 of 1