CVE-2026-32626 AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection
Attackers can achieve remote code execution on the host OS via XSS in the chat rendering pipeline due to insecure Electron configuration and lack of sanitization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-32626?
CVE-2026-32626 is a critical cross-site scripting vulnerability in Mintplexlabs Anythingllm, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, AnythingLLM Desktop contains a Streaming Phase XSS vulnerability in the chat rendering pipeline that escalates to Remote Code Execution on the host OS due to insecure Electron configuration. This works with default settings and requires no user interaction beyond normal chat usage. The custom markdown-it image renderer in frontend/src/utils/chat/markdown.js interpolates token.content directly into the alt attribute without HTML entity escaping. The PromptReply component renders this output via dangerouslySetInnerHTML without DOMPurify sanitization — unlike HistoricalMessage which correctly applies DOMPurify.sanitize().
Weakness: CWE-79
Which versions are affected by CVE-2026-32626?
It affects 1 product.
Products include Mintplexlabs Anythingllm.
How do I fix CVE-2026-32626?
No fix has been published for CVE-2026-32626 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-32626 being exploited?
There is no known exploitation of CVE-2026-32626 in the wild and no public exploit code.
Other vulnerabilities in Mintplexlabs Anythingllm
- CVE-2024-3025 Path Traversal in mintplex-labs/anything-llm
- CVE-2024-0455 SSRF on AWS deployed instances of AnythingLLM via /metadata
- CVE-2024-3104 Remote Code Execution in mintplex-labs/anything-llm
- CVE-2024-3149 SSRF in mintplex-labs/anything-llm
- CVE-2024-0765 Default user role exporting save state of instance
Sources
Also known as GHSA-rrmw-2j6x-4mf2.