Executive brief
AnythingLLM is an application that allows users to chat with AI models using their own documents and files as context. A security flaw in the system's file-searching tool allows an attacker to trick the server into executing malicious commands by providing specially crafted search patterns. If exploited, an attacker could gain full control over the server container, potentially accessing sensitive databases, API keys, and user credentials.
Technical details
An argument injection vulnerability exists in AnythingLLM's 'filesystem-search-files' agent skill due to the improper invocation of the 'ripgrep' (rg) utility. The application passes an LLM-controlled 'pattern' parameter as a positional argument without using the '--' end-of-options separator. An attacker can provide a pattern such as '--pre=/bin/sh', which ripgrep interprets as a flag to execute a preprocessor script for every file it encounters. By combining this with the 'filesystem-write-text-file' skill to drop a malicious script, an attacker can achieve arbitrary command execution within the server container. This is reachable in Docker-based deployments where the filesystem plugin is enabled by default. The issue is fixed in version 1.13.0 by implementing the '--' separator and validating that patterns do not start with hyphens.
Affected products
- Mintplex Labs AnythingLLM < 1.13.0
Timeline
- 2026-05-21: advisory: GitHub security advisory published by maintainers
- 2026-05-28: disclosed: CVE-2026-48116 published to NVD
- 2026-05-28: patched: Fix released in version 1.13.0