What’s Vulnerable › Products

mintplex-labs/anything-llm vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your mintplex-labs/anything-llm version is affected

Latest mintplex-labs/anything-llm vulnerabilities

• CVE-2026-88055 — AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator (CVSS 5.5)
• CVE-2026-72917 — AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization (CVSS 5.9)
• CVE-2026-55611 — AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion) (CVSS 0.0)
• CVE-2026-48789 — AnythingLLM: Windows path containment bypass in document folder route (CVSS 4.3)
• CVE-2023-4899 — SQL Injection in mintplex-labs/anything-llm (CVSS 8.8)
• CVE-2023-4898 — Authentication Bypass by Primary Weakness in mintplex-labs/anything-llm (CVSS 7.5)