CSSA Exclusive Early Warning10.0 Critical
LocalAI service code injection bypassing sandbox protection leading to remote command execution
An attacker can reach the unauthenticated fine-tuning task interface with a crafted HTTP request and inject malicious inline Python code into the reward function parameter. The server passes this code to the Python interpreter without security filtering, and because the built-in sandbox allowlist mechanism is flawed by design, the attacker can use class inheritance chain introspection to break out of the privilege restriction and invoke underlying operating system modules to execute arbitrary commands. The vulnerability is network-reachable and requires no credentials to trigger; affected instances face complete server compromise and malicious tampering with business logic.
Component
LocalAI is an open-source platform for locally deployed large language model inference and fine-tuning. Its architecture uses a modular backend design…
Type
Code Injection (CWE-94)
Repo
github.com/mudler/LocalAI · Stars 47753
Remediation
- It is recommended to abandon the allowlist-based interpreted sandbox and instead run untrusted code in a separate subprocess or container with isolation, alongside strict network and file access controls. Interface authentication and input filtering should also be enforced to close the script injection path entirely.
