Executive brief
AnythingLLM is a content management application that integrates with large language models to provide context during chat interactions. Managers can modify page metadata (title and favicon) through the admin interface, but these values are injected into the homepage HTML without proper escaping. When an administrator visits the homepage, an attacker with manager privileges can execute malicious scripts to steal the admin's authentication token, leading to full account takeover and unauthorized access to all workspace data, chats, users, and API keys.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in AnythingLLM's MetaGenerator component. The vulnerability exists because the /api/admin/system-preferences endpoint accepts meta_page_title and meta_page_favicon parameters from users with the manager role, which are stored unvalidated in the database and later concatenated directly into production HTML by MetaGenerator.js without HTML entity encoding. Attack requires manager-level privileges to inject the malicious payload, but achieves zero-interaction execution because the payload executes when any administrator visits the homepage /. An attacker can exfiltrate the administrator's JWT token from localStorage and use it to create API keys, read/modify workspace and chat data, delete users, and perform other privileged actions. A patch is available in versions after 1.16.1 (commit 6dff9d7 and later) which implements proper HTML escaping in the MetaGenerator.
Affected products
- Mintplex Labs AnythingLLM 1.16.1 and earlier
Timeline
- 2026-09-01: disclosed
- 2026-09-10: patched: Patch available in version after 1.16.1