Mintplex-Labs vulnerabilities

CVEs per yearBy the year they were published

1. 20235
2. 202443
3. 202510
4. 202619

Newest CVEs

• CVE-2026-88055

  AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator

  Mintplex-Labs · anything-llm

  Medium5.5
• CVE-2026-72917

  AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization

  Mintplex-Labs · anything-llm

  Medium5.9
• CVE-2026-55611

  AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion)

  Mintplex-Labs · anything-llm

  None0.0
• CVE-2026-48789

  AnythingLLM: Windows path containment bypass in document folder route

  Mintplex-Labs · anything-llm

  Medium4.3
• CVE-2026-47713

  AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration

  Mintplex-Labs · anything-llm

  Low2.0
• CVE-2026-48116

  AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill

  Mintplex-Labs · anything-llm

  High7.5
• CVE-2026-45403

  AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directory

  Mintplex-Labs · anything-llm

  Low2.0
• CVE-2026-42456

  AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR)

  Mintplex-Labs · anything-llm

  Medium4.3
• CVE-2026-41318

  AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component

  Mintplex-Labs · anything-llm

  Medium5.4
• CVE-2026-5627

  Path Traversal in mintplex-labs/anything-llm

  mintplex-labs · mintplex-labs/anything-llm

  Critical9.1