A Cross-Site Request Forgery (CSRF) vulnerability in LocalAI versions up to and including 2.15.0 allows attackers to trick victims into deleting installed models. The vulnerability was demonstrated using a proof of concept (PoC) where a victim's interaction with a malicious webpage results in the deletion of the model `gpt-4-vision-preview`. The specific patch version that addresses this vulnerability is not mentioned, indicating the need for users to update to a version later than 2.15.0.