Skip to content
OpenAdvisories

Product · Mintplex-Labs

anything-llm

19 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.5
    CVE-2026-48116

    AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill

    AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, the filesystem-search-files agent skill passes its LLM-controlled pattern parameter to ripgrep as a positional argumen…

    Mintplex-Labs anything-llm
  • High 7.7
    CVE-2026-32628

    AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter

    AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, a SQL injection vulnerability in the built-in SQL Agent plugin allows any user who can invoke the agent to execu…

    Mintplex-Labs anything-llm
  • High 7.1
    CVE-2026-32617

    AnythingLLM Permissable CORS policy

    AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, On default installations where no password or API key has been configured, all HTTP endpoints and the agent WebS…

    Mintplex-Labs anything-llm
  • High 7.2
    CVE-2026-24478

    AnythingLLM vulnerable to Path Traversal

    AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.10.0, a critical Path Traversal vulnerability in the DrupalWiki integration allows a malicious admin (or an attacker…

    Mintplex-Labs anything-llm
  • High 8.7
    CVE-2026-24477 Scanner template

    AnythingLLM has key leak in `systemSettings.js`

    AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.10.0 is configured to use Qdrant as the vector database with an API key, this QdrantApiKey could be e…

    Mintplex-Labs anything-llm
  • High 7.5
    CVE-2024-22422

    Unauthenticated Denial of Service (DOS) attack in AnythingLLM

    AnythingLLM is an application that turns any document, resource, or piece of content into context that any LLM can use as references during chatting. In versions prior to commit `08d33cfd8` an unauthenticated API route (file export) can allow attacker to cras…

    Mintplex-Labs anything-llm