Vulnerability Reportlocalai/localai:master-1781780132-3fa7b29-gpu-vulkan

This image poses a critical security risk and must not be used in production, especially as an internet-facing service. An attacker could achieve remote code execution by sending a crafted TLS certificate (CVE-2025-47917) or a malicious media file (CVE-2024-7055), leading to full compromise of the container and potentially the host. The image contains 153 vulnerabilities with severity 7.0 or higher, all remotely exploitable with no special configuration needed. While the image is from a popular community publisher and pinned by digest, the sheer volume and severity of vulnerabilities make it dangerous. No full mitigation exists without replacing the affected libraries (Mbed TLS and FFmpeg). Production use is strongly prohibited.