AI / ML CVE-2026-32719

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N) indicates a network-accessible vulnerability with high attack complexity and high privilege requirements, resulting in a moderate base score of 4.2. The attack vector is network-based and requires user interaction (plugin import action), two factors that reduce opportunistic exploitation. However, the integrity impact is high, meaning successful exploitation leads to arbitrary file write capability and code execution. The privilege requirement and user interaction components suggest this is not a worm-like vector suitable for mass automated exploitation, which aligns with a likely lower EPSS score. The lack of public POC confirmation, combined with the requirement for authenticated administrative action, places this in a lower real-world exploitation tier than its base score might initially suggest. Organizations should prioritize patching based on whether they expose AnythingLLM to untrusted users with plugin import permissions; isolated or internally-only deployments face significantly reduced risk. This is a genuine vulnerability requiring remediation but not an emergency requiring out-of-band patching for all deployments.

An administrator of an AnythingLLM instance is notified of a new community plugin available via the built-in plugin hub. The attacker has crafted a malicious ZIP archive containing a path traversal payload (e.g., '../../../var/www/html/rce.js') that, when extracted by the vulnerable ImportedPlugin.importCommunityItemFromUrl() function, writes a malicious Node.js module outside the plugins directory. Upon the next service restart or plugin reload, the injected code executes with the same privileges as the AnythingLLM server process. While this requires an authenticated admin to initiate the import (high privilege barrier), the barrier is realistic in scenarios where administrators routinely manage plugins or where social engineering convinces them to import a seemingly legitimate community plugin.