Vendor
LocalAI versions 4.6.0 through 4.11.0 are vulnerable to server-side request forgery (SSRF) allowing attackers to exfiltrate internal metadata via malicious configuration URLs.