EUVD-2026-75642Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Manager-role credential required (PR:H); admin must visit homepage for payload to fire (UI:R); full JWT theft yields complete admin takeover warranting C:H/I:H with scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and earlier, the manager role can store meta_page_title or meta_page_favicon through /api/admin/system-preferences, and MetaGenerator inserts those values into production homepage HTML without escaping attribute values or text content. The values pass unchanged through server/models/systemSettings.js and reach MetaGenerator.generate() in server/index.js. #assembleMeta() in server/utils/boot/MetaGenerator.js concatenates the stored values into HTML. When an administrator visits the homepage /, injected JavaScript can read the administrator JWT and use it to create API keys, access or modify workspace and chat data, delete users, and perform other administrator actions. server/endpoints/admin.js accepts the manager-controlled settings before server/models/systemSettings.js returns them unchanged. No fixed version is available as of this review.
AnalysisAI
Stored XSS in AnythingLLM 1.16.1 and earlier enables a manager-role user to inject arbitrary JavaScript into the application homepage by writing a malicious meta_page_title or meta_page_favicon value via /api/admin/system-preferences - MetaGenerator renders those values into page HTML without any HTML entity encoding. When an administrator visits the homepage, the injected script executes in their browser session and can exfiltrate the administrator JWT token. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid manager-role account on the target AnythingLLM instance; the manager role is a built-in privilege tier below full administrator. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS base score of 5.5 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) materially understates the real-world impact in two respects. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version has been confirmed at the time of analysis - only upstream commit 6dff9d71ab585e87a3145a48abc63c2b60151149 (https://github.com/Mintplex-Labs/anything-llm/commit/6dff9d71ab585e87a3145a48abc63c2b60151149) is available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Anything Llm
View allSQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Rated high severity (CVSS 8.8), this vulne
Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Rated high sev
XSS in AnythingLLM 1.11.1 and earlier.
Argument-injection command execution in Mintplex Labs AnythingLLM before 1.13.0 lets an attacker who can chat with an ag
SQL injection in AnythingLLM versions 1.11.1 and earlier enables authenticated users to execute arbitrary SQL commands a
AnythingLLM versions 1.11.1 and earlier contain an authentication bypass vulnerability on default installations where th
Stored DOM-level XSS in AnythingLLM's chart caption rendering allows authenticated users in shared workspaces to inject
Path traversal in AnythingLLM's document folder listing endpoint on Windows allows authenticated low-privilege users to
Stale mobile device tokens in AnythingLLM survive single-user to multi-user mode migration with a null userId, allowing
The text-to-speech endpoint in AnythingLLM prior to v1.12.1 exposes an Insecure Direct Object Reference (IDOR) allowing
AnythingLLM versions 1.11.1 and earlier contain a Zip Slip path traversal vulnerability in the community plugin import f
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatti
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today