---
id: CVE-2026-88055
title: >-
  AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in
  MetaGenerator
summary: >-
  AnythingLLM is an application that turns pieces of content into context that
  any LLM can use as references during chatting. In 1.16.1 and earlier, the
  manager role can store meta_page_title or meta_page_favicon through
  /api/admin/system-…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: Mintplex-Labs
product: anything-llm
affected:
  - anything-llm <= 1.16.1
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-10T18:15:14.387905Z'
exploitAvailable: true
published: '2026-09-10'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T18:15:36.256Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-88055'
references:
  - url: >-
      https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-rh3m-xv7m-9jhf
    label: >-
      https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-rh3m-xv7m-9jhf
  - url: >-
      https://github.com/Mintplex-Labs/anything-llm/commit/6dff9d71ab585e87a3145a48abc63c2b60151149
    label: >-
      https://github.com/Mintplex-Labs/anything-llm/commit/6dff9d71ab585e87a3145a48abc63c2b60151149
tags:
  - cve.org
  - exploit-available
epss: 0.00279
epssPercentile: 0.18191
ingestedAt: '2026-09-11T16:45:48.028Z'
---

## Overview

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and earlier, the manager role can store meta_page_title or meta_page_favicon through /api/admin/system-preferences, and MetaGenerator inserts those values into production homepage HTML without escaping attribute values or text content. The values pass unchanged through server/models/systemSettings.js and reach MetaGenerator.generate() in server/index.js. #assembleMeta() in server/utils/boot/MetaGenerator.js concatenates the stored values into HTML. When an administrator visits the homepage /, injected JavaScript can read the administrator JWT and use it to create API keys, access or modify workspace and chat data, delete users, and perform other administrator actions. server/endpoints/admin.js accepts the manager-controlled settings before server/models/systemSettings.js returns them unchanged. No fixed version is available as of this review.

## Affected

- `anything-llm <= 1.16.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.