-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe core vulnerability stems from audioToWav's unsafe command construction using user-controlled filenames without proper sanitization. The function used string interpolation to build a shell command that was executed via the 'sh' helper function, which invoked /bin/sh. This combination allowed shell metacharacters in filenames to break out of the intended command. The patch replaced both the command construction method (using argument arrays instead of string interpolation) and the execution method (using exec.Command directly instead of via shell), confirming these two functions were the vulnerability sources.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/go-skynet/LocalAI | go | < 2.10.0 | 2.10.0 |