Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-48116— AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill

Quick assessment

Affected
Mintplex-Labs anything-llm
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AnythingLLM是Mintplex开源的一个一体化AI应用程序。 AnythingLLM 1.13.0之前版本存在参数注入漏洞，该漏洞源于filesystem-search-files代理技能将LLM控制的模式参数直接传递给ripgrep作为位置参数，未使用--结束选项分隔符，导致攻击者可以通过聊天与代理交互，利用filesystem插件（官方Docker镜像中默认启用）和兄弟技能filesystem-write-text-file，在AnythingLLM服务器容器内运行任意命令。

CVSS 7.5 · High EPSS 0.54% · P43

Affected Version Matrix 1

VendorProduct Version RangeStatus
Mintplex-Labs anything-llm < 1.13.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-48116

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill
Source: CVE Program / CVE List V5
Vulnerability Description
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, the filesystem-search-files agent skill passes its LLM-controlled pattern parameter to ripgrep as a positional argument without a -- end-of-options separator. ripgrep parses any argument that starts with - as an option, so a pattern of --pre=/bin/sh turns ripgrep into a script executor: it runs /bin/sh <file> for every file it walks. An attacker who can chat with an agent on a deployment with the filesystem plugin enabled (the default in the official Docker image) can use this, together with the sibling filesystem-write-text-file skill, to run arbitrary commands inside the AnythingLLM server container. This vulnerability is fixed in 1.13.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
AnythingLLM 参数注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
AnythingLLM是Mintplex开源的一个一体化AI应用程序。 AnythingLLM 1.13.0之前版本存在参数注入漏洞，该漏洞源于filesystem-search-files代理技能将LLM控制的模式参数直接传递给ripgrep作为位置参数，未使用--结束选项分隔符，导致攻击者可以通过聊天与代理交互，利用filesystem插件（官方Docker镜像中默认启用）和兄弟技能filesystem-write-text-file，在AnythingLLM服务器容器内运行任意命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Mintplex-Labs anything-llm < 1.13.0 -

II. Public POCs for CVE-2026-48116

# POC Description Source Link Shenlong Link
AI-Generated POC Verified env Premium
Qwen3.6-35B-A3B · 7942 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-48116

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-48116 (1)

Vendor Advisories for CVE-2026-48116 (1)

Same Patch Batch · Mintplex-Labs · 2026-05-28 · 3 CVEs total

CVE-2026-45403 2.0 LOW AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside th
CVE-2026-47713 2.0 LOW AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode mi

IV. Related Vulnerabilities

Same product: anything-llm
Same vendor: Mintplex-Labs
Same weakness: CWE-77

V. Comments for CVE-2026-48116

No comments yet

Leave a comment