What is the CVSS score of CVE-2026-48116?

CVE-2026-48116 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Docker are affected by CVE-2026-48116?

AnythingLLM versions before 1.13.0 contain a remote code execution vulnerability (CVE-2026-48116, CVSS 8.8) where publicly available exploit code exists, allowing attackers with chat access to…. A patch is available.

How to fix or mitigate CVE-2026-48116?

Within 24 hours, identify all AnythingLLM instances in production and determine which versions are running, prioritizing any deployments using official Docker images with default configurations. Within 7 days, upgrade all affected instances to AnythingLLM 1.13.0 or later, or immediately disable the filesystem-search-files and filesystem-write-text-file plugins if upgrade cannot be completed immediately. Within 30 days, conduct a security audit of all AnythingLLM deployments to ensure the filesystem plugins are explicitly configured with appropriate access restrictions and validate no unauthorized commands were executed during the exposure window.

Docker CVE-2026-48116

EUVD-2026-33068 HIGH

Command Injection (CWE-77)

2026-05-28 GitHub_M

Docker Command Injection Anything Llm

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 21, 2026 - 10:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 21, 2026 - 10:22 vuln.today

cvss_changed

CVSS changed

Jul 21, 2026 - 10:22 NVD

7.5 (HIGH) 8.8 (HIGH)

Patch available

May 28, 2026 - 23:02 EUVD

Source Code Evidence Fetched

May 28, 2026 - 21:50 vuln.today

Analysis Generated

May 28, 2026 - 21:50 vuln.today

DescriptionNVD

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, the filesystem-search-files agent skill passes its LLM-controlled pattern parameter to ripgrep as a positional argument without a -- end-of-options separator. ripgrep parses any argument that starts with - as an option, so a pattern of --pre=/bin/sh turns ripgrep into a script executor: it runs /bin/sh <file> for every file it walks. An attacker who can chat with an agent on a deployment with the filesystem plugin enabled (the default in the official Docker image) can use this, together with the sibling filesystem-write-text-file skill, to run arbitrary commands inside the AnythingLLM server container. This vulnerability is fixed in 1.13.0.

AnalysisAI

Argument-injection command execution in Mintplex Labs AnythingLLM before 1.13.0 lets an attacker who can chat with an agent turn ripgrep into a script executor: the filesystem-search-files skill forwards an LLM-controlled pattern as a positional argument without a '--' separator, so a pattern like '--pre=/bin/sh' makes ripgrep run /bin/sh on every file it walks. Combined with the sibling filesystem-write-text-file skill to stage an attacker-controlled script, this yields arbitrary command execution inside the server container, which is exploitable out-of-the-box because the filesystem plugin ships enabled by default in the official Docker image. SSVC rates technical impact as total; a proof-of-concept exists but there is no public exploit weaponization and EPSS is low (0.05%).