{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.7.0"}],"component":"github.com/go-skynet/LocalAI","cve_ids":["CVE-2024-3135"],"ecosystem":"Go","epss":0.00312,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-jhvf-7c85-3c9g","id":"tcs_01M5KFE8SDC4EYKAHMVT2R6Z5D","modified_at":"2024-06-05T16:43:15.641403Z","published_at":"2024-04-01T21:30:46Z","references":["https://osv.dev/vulnerability/GHSA-jhvf-7c85-3c9g","https://nvd.nist.gov/vuln/detail/CVE-2024-3135","https://github.com/mudler/LocalAI","https://huntr.com/bounties/7afdc4d3-4b68-45ea-96d0-cf9ed3712ae8"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-jhvf-7c85-3c9g","url":"https://osv.dev/vulnerability/GHSA-jhvf-7c85-3c9g"}],"summary":"LocalAI cross-site request forgery vulnerability"}