What is the CVSS score of CVE-2026-48116?

CVE-2026-48116 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of AnythingLLM are affected by CVE-2026-48116?

AnythingLLM prior to version 1.13.0 contains a command injection vulnerability in the filesystem-search-files skill that enables execution of arbitrary commands within the server container through…. A patch is available.

How to fix or mitigate CVE-2026-48116?

Within 24 hours: Disable the filesystem-search-files plugin in AnythingLLM configuration and restrict network access to chat endpoints. Within 7 days: Audit application and container logs for exploitation attempts (search for '--pre=' command patterns in ripgrep queries); implement firewall rules limiting AnythingLLM instance access to trusted networks. Within 30 days: Monitor vendor advisories for patch availability (vulnerable versions: prior to 1.13.0); if patch released, plan immediate deployment; otherwise, evaluate permanent mitigations or platform replacement.

AnythingLLM CVE-2026-48116

EUVD-2026-33068 HIGH

Command Injection (CWE-77)

2026-05-28 GitHub_M

Docker Command Injection

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 28, 2026 - 23:02 EUVD

Source Code Evidence Fetched

May 28, 2026 - 21:50 vuln.today

Analysis Generated

May 28, 2026 - 21:50 vuln.today

DescriptionGitHub Advisory

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, the filesystem-search-files agent skill passes its LLM-controlled pattern parameter to ripgrep as a positional argument without a -- end-of-options separator. ripgrep parses any argument that starts with - as an option, so a pattern of --pre=/bin/sh turns ripgrep into a script executor: it runs /bin/sh <file> for every file it walks. An attacker who can chat with an agent on a deployment with the filesystem plugin enabled (the default in the official Docker image) can use this, together with the sibling filesystem-write-text-file skill, to run arbitrary commands inside the AnythingLLM server container. This vulnerability is fixed in 1.13.0.

AnalysisAI

Command injection in AnythingLLM prior to 1.13.0 allows attackers chatting with an agent to execute arbitrary commands inside the server container by abusing the filesystem-search-files skill. The LLM-controlled pattern parameter is passed to ripgrep without a '--' end-of-options separator, letting a crafted pattern like '--pre=/bin/sh' coerce ripgrep into executing files as shell scripts. The default official Docker image ships with the filesystem plugin enabled, making typical deployments exploitable; no public exploit identified at time of analysis.

Technical ContextAI

AnythingLLM (cpe:2.3:a:mintplex-labs:anything-llm) is a Node.js application that exposes LLM-callable 'agent skills' under server/utils/agents/aibitat/plugins/filesystem/, including search-files.js which shells out to the ripgrep binary. The flaw is a classic CWE-77 (Improper Neutralization of Special Elements used in a Command) argument injection: ripgrep treats any argv token beginning with '-' as an option, and its --pre=<command> flag designates an external preprocessor that ripgrep then invokes once per matched file. Because the agent pipeline forwarded the model-controlled pattern as a positional argument with no '--' separator, an attacker-controlled pattern was interpreted as a ripgrep option. The upstream fix (commit 94ed62d) inserts the '--' end-of-options sentinel before pattern and searchPath and additionally rejects patterns beginning with '-' as defense in depth.

RemediationAI

Upstream fix available (commit 94ed62d320df1a06c229e4bc3ee09c2cb5111b33) released in AnythingLLM 1.13.0; upgrade to 1.13.0 or later, pulling the latest official Docker image and recreating containers so the patched server/utils/agents/aibitat/plugins/filesystem/search-files.js is loaded. Until you can upgrade, disable the filesystem agent skill (specifically filesystem-search-files and filesystem-write-text-file) in the agent configuration, which removes the attack primitive at the cost of losing in-agent file search and write capabilities; alternatively restrict agent chat to fully trusted users only and place the server behind authenticated network controls, accepting that any trusted user who can be social-engineered still inherits RCE risk. See the GitHub Security Advisory at https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-6hrp-7mw6-8v59 and the patch at https://github.com/Mintplex-Labs/anything-llm/commit/94ed62d320df1a06c229e4bc3ee09c2cb5111b33.