Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

anything-llm — Vulnerabilities & Security Advisories 11

All 11 CVE vulnerabilities found in anything-llm, with AI-generated Chinese analysis, references, and POCs.

Vendor: Mintplex-Labs

CVE IDTitleCVSSSeverityPublished
CVE-2026-41318 AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component CWE-79 5.4 Medium2026-04-24
CVE-2026-32719 AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import CWE-22 4.2 Medium2026-03-13
CVE-2026-32717 AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys CWE-863 2.7 Low2026-03-13
CVE-2026-32715 AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences CWE-863 3.8 Low2026-03-13
CVE-2026-32628 AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter CWE-89 8.8 -2026-03-13
CVE-2026-32626 AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection CWE-79 9.7 Critical2026-03-13
CVE-2026-32617 AnythingLLM Permissable CORS policy CWE-942 7.1 High2026-03-13
CVE-2026-24478 AnythingLLM vulnerable to Path Traversal CWE-22 7.2 High2026-01-26
CVE-2026-24477 AnythingLLM has key leak in `systemSettings.js` CWE-201 9.1AICriticalAI2026-01-26
CVE-2026-21484 AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery CWE-203 5.3 Medium2026-01-03
CVE-2024-22422 Unauthenticated Denial of Service (DOS) attack in AnythingLLM CWE-754 7.5 High2024-01-19

All 11 known CVE vulnerabilities affecting anything-llm with full Chinese analysis, references, and POCs where available.