CVE-2024-3166 json
Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llm
published 2024-06-06 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-31763
- cvss
- 3.4
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 62%
- public exploits
- 0
- none known
Summary
A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to fetch and embed content from websites into workspaces, which can be exploited to execute arbitrary JavaScript code. In the desktop application, this flaw can be escalated to Remote Code Execution (RCE) due to insecure application settings, specifically the enabling of 'nodeIntegration' and the disabling of 'contextIsolation' in Electron's webPreferences. The issue has been addressed in version 1.4.2 of the desktop application.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.97% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/af288bd3-8824-4216-a294-ae9fb444e5db referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 3.4 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N |
| NVD | 3.1 | 9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
Affected products
- mintplex-labs mintplex-labs/anything-llm
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/mintplex-labs/anything-llm/commit/fa27103d032c58904c49b92ee13fabc19a20a5ce
patch
-
huntr.com
/bounties/af288bd3-8824-4216-a294-ae9fb444e5db
exploit, third-party-advisory
Sources
- CVE List CVE-2024-3166
- NVD CVE-2024-3166
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.