AnythingLLM combines chat UI, RAG pipelines, vector stores, and agent tools. Hardening must cover workspace isolation, connector credentials, and tool execution boundaries.
Vulnerability Details:
- CVE: CVE-2026-32626
- GHSA: GHSA-rrmw-2j6x-4mf2
- CVSS Score: 9.7 (Critical)
- Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
- Affected: Versions ≤ 1.11.1
- Fixed: 1.11.2
- Published: March 13, 2026
- Type: CWE-79 (XSS) → RCE via Electron
Description: Streaming Phase XSS vulnerability in the chat rendering pipeline escalates to Remote Code Execution due to insecure Electron configuration. Attackers can inject malicious scripts via LLM responses using markdown image payloads.
Impact:
- Arbitrary code execution on host OS (desktop app)
- Full system compromise via Node.js APIs
- Access to files, credentials, and network resources
- Complete confidentiality, integrity, and availability compromise
Attack Vector:
Action Required:
- Desktop App Users: Upgrade immediately to v1.11.2 or higher
- Docker Users: Lower risk (browser sandbox), but update recommended
- Review logs for suspicious activity if running ≤ 1.11.1
Vulnerability Details:
- CVE: CVE-2026-24477
- GHSA: GHSA-gm94-qc2p-xcwf
- CVSS Score: 8.7 (High)
- Affected: Versions < 1.10.0
- Fixed: 1.10.0
- Published: January 24, 2026
Description: Unauthenticated endpoint /api/setup-complete exposes Qdrant/Weaviate API keys due to missing conditional logic in systemSettings.js.
Impact:
- Full read/write access to vector database
- Data exfiltration from RAG knowledge base
- Cross-workspace data exposure
Action Required:
- Upgrade immediately to v1.10.0 or higher
- Rotate exposed API keys if running vulnerable versions
Vulnerability Details:
- CVE: CVE-2026-24478
- GHSA: GHSA-jp2f-99h9-7vjv
- CVSS Score: 7.2 (High)
- Affected: Versions < 1.10.0
- Fixed: 1.10.0
- Published: January 24, 2026
Description: Unsafe filename handling in DrupalWiki integration allows arbitrary file write via ../../ path traversal.
Impact:
- Arbitrary file write
- Potential RCE by overwriting config files
Action Required:
- Upgrade immediately to v1.10.0 or higher
¶ 1) Lock down authentication and workspace policy
- Require authenticated access and disable anonymous use in production.
- Create separate workspaces for teams with different data classification levels.
- Restrict admin panel access to trusted networks.
- Rotate API/session tokens regularly.
¶ 2) Protect connectors, embeddings, and vector backends
- Keep provider keys and database credentials in environment secrets.
- Limit connector scope for cloud drives and external APIs.
- Restrict outbound network egress to approved model and embedding endpoints.
- Apply TLS for vector database traffic where supported.
- Disable unnecessary agent tools and integrations.
- Review tool permissions before enabling shell, webhook, or code actions.
- Log tool invocations and investigate unexpected high-risk actions.
- Patch quickly when upstream security fixes are released.
- AnythingLLM official site/docs: https://anythingllm.com/
- AnythingLLM source repository: https://github.com/Mintplex-Labs/anything-llm
- Security advisories: https://github.com/Mintplex-Labs/anything-llm/security/advisories
Keep AnythingLLM updated to protect against known security issues. 13 security advisories have been disclosed (Jan 2024 - Mar 2026).
| GHSA ID |
CVE |
Vulnerability |
Severity |
CVSS |
Fixed Version |
Published |
| GHSA-rrmw-2j6x-4mf2 |
CVE-2026-32626 |
XSS to RCE via LLM Response Injection |
Critical |
9.7 |
v1.11.2 |
Mar 13, 2026 |
| GHSA-gm94-qc2p-xcwf |
CVE-2026-24477 |
API key leak in systemSettings.js (Qdrant/Weaviate) |
High |
8.7 |
v1.10.0 |
Jan 24, 2026 |
| GHSA-jp2f-99h9-7vjv |
CVE-2026-24478 |
Path traversal in DrupalWiki (arbitrary file write/RCE) |
High |
7.2 |
v1.10.0 |
Jan 24, 2026 |
| GHSA-jwjx-mw2p-5wc7 |
- |
SQL Injection in SQL Agent Plugin (table_name parameter) |
High |
- |
- |
Mar 13, 2026 |
| GHSA-24qj-pw4h-3jmm |
CVE-2026-32617 |
Permissive CORS policy |
High |
- |
- |
Mar 12, 2026 |
| GHSA-7hpg-6pc7-cx86 |
- |
Ollama token leak in systemSettings.js (GHSL-2025-056) |
High |
- |
- |
May 7, 2025 |
| GHSA-xmj6-g32r-fc5q |
- |
Unauthenticated DOS attack in file exports (EISDIR crash) |
High |
7.5 |
- |
Jan 18, 2024 |
| GHSA-2qmm-82f7-8qj5 |
- |
IDOR Cross-User Chat Feedback Manipulation |
Moderate |
- |
- |
Mar 13, 2026 |
| GHSA-rh66-4w74-cf4m |
- |
Zip Slip Path Traversal via Community Hub Plugin |
Moderate |
- |
- |
Mar 13, 2026 |
| GHSA-p5rf-8p88-979c |
CVE-2026-32628 |
Cross-Workspace IDOR in Parsed Files API |
Moderate |
- |
- |
Mar 13, 2026 |
| GHSA-47vr-w3vm-69ch |
- |
Username Enumeration with Password Recovery |
Moderate |
5.3 |
- |
Jan 2, 2026 |
| GHSA-wfq3-65gm-3g2p |
- |
Manager Privilege Bypass (Admin-only System Preferences) |
Low |
- |
- |
Mar 13, 2026 |
| GHSA-7754-8jcc-2rg3 |
CVE-2026-32717 |
Suspended Users API Key Access (Browser Extension) |
Low |
- |
- |
Mar 13, 2026 |
CVE-2026-32626 (GHSA-rrmw-2j6x-4mf2) - XSS to RCE via LLM Response Injection (Mar 13, 2026)
- Streaming phase XSS vulnerability allows attackers to inject malicious scripts via LLM responses
- Escalates to RCE in Electron desktop app via nodeIntegration
- CVSS 9.7 (Critical)
- Fixed in v1.11.2
- Desktop app users must update immediately
GHSA-rrmw-2j6x-4mf2 - XSS to RCE via LLM Response Injection (Mar 13, 2026)
- Streaming phase XSS vulnerability allows attackers to inject malicious scripts via LLM responses
- Can lead to remote code execution in the browser context
- Affects all versions prior to fix
CVE-2026-24477 (GHSA-gm94-qc2p-xcwf) - API Key Leak (Jan 24, 2026)
- Unauthenticated endpoint
/api/setup-complete exposes Qdrant/Weaviate API keys
- Missing conditional logic in
systemSettings.js serialization
- CVSS 8.7 (High) - Network, Low Complexity, No Auth Required
- Fixed in v1.10.0
CVE-2026-24478 (GHSA-jp2f-99h9-7vjv) - Path Traversal in DrupalWiki (Jan 24, 2026)
- Unsafe filename handling in
_downloadAndProcessAttachments method
- Allows arbitrary file write via
../../ path traversal
- Can lead to RCE by overwriting config files or writing scripts
- CVSS 7.2 (High)
- Fixed in v1.10.0
GHSA-jwjx-mw2p-5wc7 - SQL Injection in SQL Agent Plugin (Mar 13, 2026)
- Unsanitized
table_name parameter in SQL agent
- Allows SQL injection attacks against connected databases
GHSA-24qj-pw4h-3jmm - Permissive CORS Policy (Mar 12, 2026)
- Overly permissive Cross-Origin Resource Sharing configuration
- May allow unauthorized cross-origin requests
GHSA-7hpg-6pc7-cx86 - Ollama Token Leak (May 7, 2025)
- Ollama API token exposed in
systemSettings.js
- Part of GitHub Security Lab audit (GHSL-2025-056)
GHSA-xmj6-g32r-fc5q - Unauthenticated DOS (Jan 18, 2024)
- Denial of Service via file exports endpoint
- EISDIR crash vulnerability
GHSA-2qmm-82f7-8qj5 - IDOR Cross-User Chat Feedback (Mar 13, 2026)
- Insecure Direct Object Reference allows chat feedback manipulation across users
GHSA-rh66-4w74-cf4m - Zip Slip Path Traversal (Mar 13, 2026)
- Community Hub plugin import vulnerable to Zip Slip attack
- Can lead to code execution via malicious plugin packages
GHSA-p5rf-8p88-979c - Cross-Workspace IDOR (Mar 13, 2026)
- Parsed Files API allows unauthorized file deletion across workspaces
GHSA-47vr-w3vm-69ch - Username Enumeration (Jan 2, 2026)
- Password recovery feature allows username enumeration
- Observable response discrepancy reveals valid usernames
GHSA-wfq3-65gm-3g2p - Manager Privilege Bypass (Mar 13, 2026)
- Managers can bypass restrictions to access admin-only system preferences
GHSA-7754-8jcc-2rg3 - Suspended Users API Key Access (Mar 13, 2026)
- Suspended users can continue using Browser Extension API keys
- Update immediately to v1.11.2 or later (latest: v1.11.2, March 18, 2026)
- Desktop App Users: Critical security fix for CVE-2026-32626 (XSS to RCE)
- Docker Users: Lower risk but update recommended
- Monitor security advisories: https://github.com/Mintplex-Labs/anything-llm/security/advisories
- Rotate all API keys if running versions prior to v1.10.0
- Audit logs for suspicious activity if previously exposed
- Implement network segmentation to limit exposure
- Use reverse proxy with TLS for all production deployments
- Enable multi-user mode for team deployments with proper access controls
Any questions?
Feel free to contact us. Find all contact information on our contact page.