anything-llm vulnerabilities

2 known vulnerabilities in anything-llm from Mintplexlabs. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  mintplex-labs/anything-llm: Improper Handling of Exceptional Conditions

  CVE-2024-3150Jun 6, 2024Mintplex-labs

  In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles to escalate their privileges to Administrator. The issue arises from improper input validation when handling HTTP POST requests t

• 9.1 Critical severity

  mintplex-labs/anything-llm: Improperly Controlled Modification of Dynamically-Determined Object Attributes

  CVE-2024-0404Apr 16, 2024Mintplex-labs

  A mass assignment vulnerability exists in the `/api/invite/:code` endpoint of the mintplex-labs/anything-llm repository, allowing unauthorized creation of high-privileged accounts. By intercepting and modifying the HTTP request during the account creation proc