CVE-2026-32626

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32626", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-12T15:29:36.558Z", "datePublished": "2026-03-13T20:14:30.437Z", "dateUpdated": "2026-03-16T20:13:43.696Z"}, "containers": {"cna": {"title": "AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.7, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-rrmw-2j6x-4mf2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-rrmw-2j6x-4mf2"}, {"name": "https://github.com/Mintplex-Labs/anything-llm/commit/9e2d144dc8be6fab29f560f5bcdaa9ef7dbb4214", "tags": ["x_refsource_MISC"], "url": "https://github.com/Mintplex-Labs/anything-llm/commit/9e2d144dc8be6fab29f560f5bcdaa9ef7dbb4214"}], "affected": [{"vendor": "Mintplex-Labs", "product": "anything-llm", "versions": [{"version": "<= 1.11.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T20:14:30.437Z"}, "descriptions": [{"lang": "en", "value": "AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, AnythingLLM Desktop contains a Streaming Phase XSS vulnerability in the chat rendering pipeline that escalates to Remote Code Execution on the host OS due to insecure Electron configuration. This works with default settings and requires no user interaction beyond normal chat usage. The custom markdown-it image renderer in frontend/src/utils/chat/markdown.js interpolates token.content directly into the alt attribute without HTML entity escaping. The PromptReply component renders this output via dangerouslySetInnerHTML without DOMPurify sanitization \u2014 unlike HistoricalMessage which correctly applies DOMPurify.sanitize()."}], "source": {"advisory": "GHSA-rrmw-2j6x-4mf2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T20:13:03.259781Z", "id": "CVE-2026-32626", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T20:13:43.696Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32626", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-16T20:13:03.259781Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T20:13:39.523Z"}}], "cna": {"title": "AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection", "source": {"advisory": "GHSA-rrmw-2j6x-4mf2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.7, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Mintplex-Labs", "product": "anything-llm", "versions": [{"status": "affected", "version": "<= 1.11.1"}]}], "references": [{"url": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-rrmw-2j6x-4mf2", "name": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-rrmw-2j6x-4mf2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Mintplex-Labs/anything-llm/commit/9e2d144dc8be6fab29f560f5bcdaa9ef7dbb4214", "name": "https://github.com/Mintplex-Labs/anything-llm/commit/9e2d144dc8be6fab29f560f5bcdaa9ef7dbb4214", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, AnythingLLM Desktop contains a Streaming Phase XSS vulnerability in the chat rendering pipeline that escalates to Remote Code Execution on the host OS due to insecure Electron configuration. This works with default settings and requires no user interaction beyond normal chat usage. The custom markdown-it image renderer in frontend/src/utils/chat/markdown.js interpolates token.content directly into the alt attribute without HTML entity escaping. The PromptReply component renders this output via dangerouslySetInnerHTML without DOMPurify sanitization \u2014 unlike HistoricalMessage which correctly applies DOMPurify.sanitize()."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-13T20:14:30.437Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32626", "state": "PUBLISHED", "dateUpdated": "2026-03-16T20:13:43.696Z", "dateReserved": "2026-03-12T15:29:36.558Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-13T20:14:30.437Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "anything-llm", "vendor": "Mintplex-Labs", "versions": [{"status": "affected", "version": "<= 1.11.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:*", "matchCriteriaId": "384FD8C3-E046-493C-9996-8E3042229081", "versionEndIncluding": "1.11.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, AnythingLLM Desktop contains a Streaming Phase XSS vulnerability in the chat rendering pipeline that escalates to Remote Code Execution on the host OS due to insecure Electron configuration. This works with default settings and requires no user interaction beyond normal chat usage. The custom markdown-it image renderer in frontend/src/utils/chat/markdown.js interpolates token.content directly into the alt attribute without HTML entity escaping. The PromptReply component renders this output via dangerouslySetInnerHTML without DOMPurify sanitization \u2014 unlike HistoricalMessage which correctly applies DOMPurify.sanitize()."}, {"lang": "es", "value": "AnythingLLM es una aplicaci\u00f3n que convierte fragmentos de contenido en contexto que cualquier LLM puede usar como referencias durante el chat. En la versi\u00f3n 1.11.1 y anteriores, AnythingLLM Desktop contiene una vulnerabilidad XSS de fase de streaming en la canalizaci\u00f3n de renderizado del chat que escala a ejecuci\u00f3n remota de c\u00f3digo en el sistema operativo anfitri\u00f3n debido a una configuraci\u00f3n insegura de Electron. Esto funciona con la configuraci\u00f3n predeterminada y no requiere interacci\u00f3n del usuario m\u00e1s all\u00e1 del uso normal del chat. El renderizador de im\u00e1genes personalizado de markdown-it en frontend/src/utils/chat/markdown.js interpola token.content directamente en el atributo alt sin escape de entidades HTML. El componente PromptReply renderiza esta salida a trav\u00e9s de dangerouslySetInnerHTML sin la sanitizaci\u00f3n de DOMPurify, a diferencia de HistoricalMessage, que aplica correctamente DOMPurify.sanitize()."}], "id": "CVE-2026-32626", "lastModified": "2026-06-17T10:36:07.507", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32626", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-16T20:13:03.259781Z", "version": "2.0.3"}}]}, "published": "2026-03-16T14:19:40.033", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/Mintplex-Labs/anything-llm/commit/9e2d144dc8be6fab29f560f5bcdaa9ef7dbb4214"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-rrmw-2j6x-4mf2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.11.1]"}}], "enrichment": {"confidence": 98.0, "confidence_source": "matching", "scores": [{"score": 98.0, "source": "matching"}]}, "original": {"product": "anything-llm", "source": "cna", "vendor": "Mintplex-Labs"}, "product": "anything-llm", "vendor": "mintplexlabs"}], "analysis": {"en": {"generated_at": "2026-03-16T23:08:40.763769+00:00", "value": {"mitigation_remediation": ["Update AnythingLLM Desktop to the latest patched version (1.11.2 or later)."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Affected systems are desktop installations of AnythingLLM provided by Mintplex-Labs, specifically version 1.11.1 and all earlier releases. The vulnerability originates from the default Electron configuration, which remains unchanged until an upgrade. Users running these versions are at risk if they engage in normal chat usage with any LLM that can supply injected content, and the flaw exists without additional user interaction.", "description_and_impact": "AnythingLLM Desktop 1.11.1 and earlier contains a Streaming Phase cross\u2011site scripting flaw in the chat rendering pipeline that can be escalated to remote code execution on the host OS. The flaw arises from the custom markdown-it image renderer that inserts unescaped token.content into the alt attribute, while the rendered output is injected into the DOM via dangerouslySetInnerHTML without DOMPurify sanitization. This allows an attacker who can influence the LLM response to inject malicious JavaScript that runs with the desktop application's privileges, potentially compromising system integrity and confidentiality.", "risk_and_exploitability": "Risk assessment: The CVSS base score of 9.7 classifies this as critical, while the EPSS score of less than 1% indicates low current exploit prevalence. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only normal chat interaction with the vulnerable version; once malicious content is rendered, the JavaScript runs with full desktop process privileges, potentially giving an attacker full control over the host system."}}}}, "created": "2026-03-16T09:23:54.557817+00:00", "updated": "2026-03-23T13:39:57.676326+00:00", "vendors": ["mintplexlabs", "mintplexlabs$PRODUCT$anything-llm"]}