anything-llm vulnerabilities
7 known vulnerabilities in anything-llm from Mintplex-labs. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
anything-llm: Improper Neutralization of Special Elements used in a Command
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, the filesystem-search-files agent skill passes its LLM-controlled pattern parameter to ripgrep as a positional argument
- 8.8 High severity
anything-llm: Improper Neutralization of Special Elements used in an SQL Command
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, a SQL injection vulnerability in the built-in SQL Agent plugin allows any user who can invoke the agent to execut
- 9.6 Critical severity
anything-llm: Improper Neutralization of Input During Web Page Generation
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, AnythingLLM Desktop contains a Streaming Phase XSS vulnerability in the chat rendering pipeline that escalates to
- 7.5 High severity
anything-llm: Permissive Cross-domain Security Policy with Untrusted Domains
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, On default installations where no password or API key has been configured, all HTTP endpoints and the agent WebSo
- 7.2 High severity
anything-llm: Improper Limitation of a Pathname to a Restricted Directory
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.10.0, a critical Path Traversal vulnerability in the DrupalWiki integration allows a malicious admin (or an attacker
- 7.5 High severity
anything-llm: Insertion of Sensitive Information Into Sent Data
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.10.0 is configured to use Qdrant as the vector database with an API key, this QdrantApiKey could be ex
- 7.5 High severity
anything-llm: Improper Check for Unusual or Exceptional Conditions
AnythingLLM is an application that turns any document, resource, or piece of content into context that any LLM can use as references during chatting. In versions prior to commit `08d33cfd8` an unauthenticated API route (file export) can allow attacker to crash