AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection

AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill

AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter

AnythingLLM Permissable CORS policy

AnythingLLM has key leak in `systemSettings.js`

Unauthenticated Denial of Service (DOS) attack in AnythingLLM

AnythingLLM vulnerable to Path Traversal

AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import

AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization

AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator

AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component

AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery

AnythingLLM: Windows path containment bypass in document folder route

AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration

AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR)

AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences

AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys

AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directory

AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion)