EUVD-2026-33068Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 21, 2026
Argument-injection command execution in Mintplex Labs AnythingLLM before 1.13.0 lets an attacker who can chat with an agent turn ripgrep into a script executor: the filesystem-search-files skill forwards an LLM-controlled pattern as a positional argument without a '--' separator, so a pattern like '--pre=/bin/sh' makes ripgrep run /bin/sh on every file it walks. Combined with the sibling filesystem-write-text-file skill to stage an attacker-controlled script, this yields arbitrary command execution inside the server container, which is exploitable out-of-the-box because the filesystem plugin ships enabled by default in the official Docker image. SSVC rates technical impact as total; a proof-of-concept exists but there is no public exploit weaponization and EPSS is low (0.05%).
Earlier versions of this analysis (1)
Command injection in AnythingLLM prior to 1.13.0 allows attackers chatting with an agent to execute arbitrary commands inside the server container by abusing the filesystem-search-files skill. The LLM-controlled pattern parameter is passed to ripgrep without a '--' end-of-options separator, letting a crafted pattern like '--pre=/bin/sh' coerce ripgrep into executing files as shell scripts. The default official Docker image ships with the filesystem plugin enabled, making typical deployments exploitable; no public exploit identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Docker gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, the filesystem-search-files agent skill passes its LLM-controlled pattern parameter to ripgrep as a positional argument without a -- end-of-options separator. ripgrep parses any argument that starts with - as an option, so a pattern of --pre=/bin/sh turns ripgrep into a script executor: it runs /bin/sh <file> for every file it walks. An attacker who can chat with an agent on a deployment with the filesystem plugin enabled (the default in the official Docker image) can use this, together with the sibling filesystem-write-text-file skill, to run arbitrary commands inside the AnythingLLM server container. This vulnerability is fixed in 1.13.0.
Executive ViewAI
AnythingLLM versions before 1.13.0 contain a remote code execution vulnerability (CVE-2026-48116, CVSS 8.8) where publicly available exploit code exists, allowing attackers with chat access to execute arbitrary commands within the application server. This vulnerability affects deployments using the default Docker image configuration, where the vulnerable filesystem plugins ship enabled out-of-the-box. Successful exploitation would grant attackers full control over the AnythingLLM container, potentially compromising sensitive data processed by the application and enabling lateral movement within the network.
Within 24 hours, identify all AnythingLLM instances in production and determine which versions are running, prioritizing any deployments using official Docker images with default configurations. Within 7 days, upgrade all affected instances to AnythingLLM 1.13.0 or later, or immediately disable the filesystem-search-files and filesystem-write-text-file plugins if upgrade cannot be completed immediately. Within 30 days, conduct a security audit of all AnythingLLM deployments to ensure the filesystem plugins are explicitly configured with appropriate access restrictions and validate no unauthorized commands were executed during the exposure window.
Apply vendor patch: upgrade to AnythingLLM 1.13.0 or later. As interim mitigation, disable the filesystem-search-files and filesystem-write-text-file plugins in AnythingLLM configuration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
runc through version 1.0-rc6 (used in Docker before 18.09.2) contains a container escape vulnerability that allows attac
Netmaker makes networks with WireGuard. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no a
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
The News & Blog Designer Pack - WordPress Blog Plugin - (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post
Path traversal in JFrog Artifactory (CWE-22) enables an authenticated low-privilege user to write data outside the inten
Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build
Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-config
Unauthenticated remote command injection in SGWBOX N3 firmware 2.0.25 lets attackers execute arbitrary operating-system
Remote code execution in Flowise before 3.1.2 allows any authenticated user (or API caller with chatflow view/update per
Remote code execution in NocoBase Workflow Script Node (npm @nocobase/plugin-workflow-javascript) allows authenticated l
Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-c
Exploit-DB