Anything Llm
Monthly
Unauthorized deletion of parsed files in AnythingLLM versions 1.11.1 through 1.14.0 allows authenticated managers or admins to delete parsed files belonging to other users across any workspace by enumerating integer file IDs via the embed-parsed-file endpoint. A proof-of-concept exploit exists, but the attack requires high privileges and manual file ID discovery, limiting widespread exploitability. The issue is patched in version 1.14.1.
Path traversal in AnythingLLM's document folder listing endpoint on Windows allows authenticated low-privilege users to enumerate directories outside the intended documents directory. The root cause is a platform-specific gap in the shared path containment helper: it correctly rejects POSIX-style '../' sequences but fails to reject Windows-style parent path segments produced by Node.js path.relative(), such as bare '..'. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, consistent with the Medium CVSS score of 4.3 and the authentication requirement.
Stale mobile device tokens in AnythingLLM survive single-user to multi-user mode migration with a null userId, allowing a pre-migration token holder to bypass per-user data filtering and access other users' workspace content. Affected are all AnythingLLM installations (cpe:2.3:a:mintplex-labs:anything-llm) prior to version 1.13.0 that have undergone a single-user to multi-user migration while mobile device tokens existed. An attacker retaining a previously approved mobile token can enumerate workspaces and retrieve thread metadata and chat history belonging to other users. No public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Argument-injection command execution in Mintplex Labs AnythingLLM before 1.13.0 lets an attacker who can chat with an agent turn ripgrep into a script executor: the filesystem-search-files skill forwards an LLM-controlled pattern as a positional argument without a '--' separator, so a pattern like '--pre=/bin/sh' makes ripgrep run /bin/sh on every file it walks. Combined with the sibling filesystem-write-text-file skill to stage an attacker-controlled script, this yields arbitrary command execution inside the server container, which is exploitable out-of-the-box because the filesystem plugin ships enabled by default in the official Docker image. SSVC rates technical impact as total; a proof-of-concept exists but there is no public exploit weaponization and EPSS is low (0.05%).
Symlink following in the AnythingLLM agent filesystem copy tool (versions prior to 1.13.0) allows a highly-privileged authenticated user to read files outside the configured filesystem sandbox by placing a symbolic link inside an agent-accessible source directory. The recursive copy helper validates only top-level paths, then descends into child entries using Node.js fs.stat() and fs.copyFile(), both of which transparently follow symlinks - silently redirecting reads to targets outside the allowed root and materializing their contents in an accessible destination. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS score of 2.0 reflects that exploitation is constrained to high-privilege accounts with high complexity and required user interaction.
The text-to-speech endpoint in AnythingLLM prior to v1.12.1 exposes an Insecure Direct Object Reference (IDOR) allowing any authenticated workspace member to retrieve audio renderings of another user's private chat responses by supplying a foreign chatId. The route validated workspace membership but omitted per-row ownership enforcement, making lateral access within a shared workspace trivial for a low-privileged attacker. No active exploitation is confirmed (absent from CISA KEV), though SSVC classifies exploitation as poc-level, and EPSS is negligible at 0.01%, consistent with a targeted rather than opportunistic threat.
Stored DOM-level XSS in AnythingLLM's chart caption rendering allows authenticated users in shared workspaces to inject malicious markdown via indirect prompt injection, affecting all other users who view the compromised conversation. The vulnerability stems from unsafe markdown-to-HTML conversion in the Chartable component that bypasses the application's standard DOMPurify sanitization defense-in-depth. Versions prior to 1.12.1 are affected; patch available.
AnythingLLM versions 1.11.1 and earlier contain a Zip Slip path traversal vulnerability in the community plugin import functionality that fails to validate file paths during ZIP extraction. An authenticated attacker with high privileges can craft a malicious ZIP file containing path traversal sequences that, when imported via the community hub, extract files outside the intended directory and achieve arbitrary code execution on the server. While the CVSS score is moderate (4.2) due to high privilege requirements and user interaction, the vulnerability enables code execution and should be addressed promptly.
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.
SQL injection in AnythingLLM versions 1.11.1 and earlier enables authenticated users to execute arbitrary SQL commands against connected PostgreSQL, MySQL, and MSSQL databases through the built-in SQL Agent plugin. The vulnerability stems from unsafe string concatenation of table names in the getTableSchemaSql() method across all three database connectors, bypassing proper parameterization. Any user with access to invoke the SQL Agent can exploit this to read, modify, or delete sensitive database contents.
XSS in AnythingLLM 1.11.1 and earlier.
AnythingLLM versions 1.11.1 and earlier contain an authentication bypass vulnerability on default installations where the application's HTTP endpoints and WebSocket connections lack proper authentication and accept requests from any origin. While rated CVSS 7.1, exploitation is limited to attackers on the same local network due to browser Private Network Access (PNA) protections, making this a medium-priority issue for most deployments.
SQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unauthorized deletion of parsed files in AnythingLLM versions 1.11.1 through 1.14.0 allows authenticated managers or admins to delete parsed files belonging to other users across any workspace by enumerating integer file IDs via the embed-parsed-file endpoint. A proof-of-concept exploit exists, but the attack requires high privileges and manual file ID discovery, limiting widespread exploitability. The issue is patched in version 1.14.1.
Path traversal in AnythingLLM's document folder listing endpoint on Windows allows authenticated low-privilege users to enumerate directories outside the intended documents directory. The root cause is a platform-specific gap in the shared path containment helper: it correctly rejects POSIX-style '../' sequences but fails to reject Windows-style parent path segments produced by Node.js path.relative(), such as bare '..'. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, consistent with the Medium CVSS score of 4.3 and the authentication requirement.
Stale mobile device tokens in AnythingLLM survive single-user to multi-user mode migration with a null userId, allowing a pre-migration token holder to bypass per-user data filtering and access other users' workspace content. Affected are all AnythingLLM installations (cpe:2.3:a:mintplex-labs:anything-llm) prior to version 1.13.0 that have undergone a single-user to multi-user migration while mobile device tokens existed. An attacker retaining a previously approved mobile token can enumerate workspaces and retrieve thread metadata and chat history belonging to other users. No public exploit identified at time of analysis and this CVE is not listed in CISA KEV.
Argument-injection command execution in Mintplex Labs AnythingLLM before 1.13.0 lets an attacker who can chat with an agent turn ripgrep into a script executor: the filesystem-search-files skill forwards an LLM-controlled pattern as a positional argument without a '--' separator, so a pattern like '--pre=/bin/sh' makes ripgrep run /bin/sh on every file it walks. Combined with the sibling filesystem-write-text-file skill to stage an attacker-controlled script, this yields arbitrary command execution inside the server container, which is exploitable out-of-the-box because the filesystem plugin ships enabled by default in the official Docker image. SSVC rates technical impact as total; a proof-of-concept exists but there is no public exploit weaponization and EPSS is low (0.05%).
Symlink following in the AnythingLLM agent filesystem copy tool (versions prior to 1.13.0) allows a highly-privileged authenticated user to read files outside the configured filesystem sandbox by placing a symbolic link inside an agent-accessible source directory. The recursive copy helper validates only top-level paths, then descends into child entries using Node.js fs.stat() and fs.copyFile(), both of which transparently follow symlinks - silently redirecting reads to targets outside the allowed root and materializing their contents in an accessible destination. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the CVSS score of 2.0 reflects that exploitation is constrained to high-privilege accounts with high complexity and required user interaction.
The text-to-speech endpoint in AnythingLLM prior to v1.12.1 exposes an Insecure Direct Object Reference (IDOR) allowing any authenticated workspace member to retrieve audio renderings of another user's private chat responses by supplying a foreign chatId. The route validated workspace membership but omitted per-row ownership enforcement, making lateral access within a shared workspace trivial for a low-privileged attacker. No active exploitation is confirmed (absent from CISA KEV), though SSVC classifies exploitation as poc-level, and EPSS is negligible at 0.01%, consistent with a targeted rather than opportunistic threat.
Stored DOM-level XSS in AnythingLLM's chart caption rendering allows authenticated users in shared workspaces to inject malicious markdown via indirect prompt injection, affecting all other users who view the compromised conversation. The vulnerability stems from unsafe markdown-to-HTML conversion in the Chartable component that bypasses the application's standard DOMPurify sanitization defense-in-depth. Versions prior to 1.12.1 are affected; patch available.
AnythingLLM versions 1.11.1 and earlier contain a Zip Slip path traversal vulnerability in the community plugin import functionality that fails to validate file paths during ZIP extraction. An authenticated attacker with high privileges can craft a malicious ZIP file containing path traversal sequences that, when imported via the community hub, extract files outside the intended directory and achieve arbitrary code execution on the server. While the CVSS score is moderate (4.2) due to high privilege requirements and user interaction, the vulnerability enables code execution and should be addressed promptly.
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.
SQL injection in AnythingLLM versions 1.11.1 and earlier enables authenticated users to execute arbitrary SQL commands against connected PostgreSQL, MySQL, and MSSQL databases through the built-in SQL Agent plugin. The vulnerability stems from unsafe string concatenation of table names in the getTableSchemaSql() method across all three database connectors, bypassing proper parameterization. Any user with access to invoke the SQL Agent can exploit this to read, modify, or delete sensitive database contents.
XSS in AnythingLLM 1.11.1 and earlier.
AnythingLLM versions 1.11.1 and earlier contain an authentication bypass vulnerability on default installations where the application's HTTP endpoints and WebSocket connections lack proper authentication and accept requests from any origin. While rated CVSS 7.1, exploitation is limited to attackers on the same local network due to browser Private Network Access (PNA) protections, making this a medium-priority issue for most deployments.
SQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.