Prisma Injection in mintplex-labs/anything-llm

A vulnerability in mintplex-labs/anything-llm prior to version 1.2.2 allows for Prisma injection. The issue exists in the API endpoint "/embed/:embedId/stream-chat" where user-provided JSON is directly taken to the Prisma library's where clause. An attacker can exploit this by providing a specially crafted JSON object, such as {"sessionId":{"not":"a"}}, causing Prisma to return all data from the table. This can lead to unauthorized access to all user queries in embedded chat mode.

N/A

SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

anything-llm 输入验证错误漏洞

anything-llm是Mintplex开源的一个一体式桌面和 Docker AI 应用程序。 anything-llm 1.2.2之前版本存在输入验证错误漏洞，该漏洞源于API端点/embed/:embedId/stream-chat存在Prisma注入，攻击者可以通过提供特制的JSON对象访问所有用户查询。

N/A

N/A