anything-llm vulnerabilities

CVEs whose affected-version data names the anything-llm package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-88055Medium· 5.5PoC

2w ago

AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and earlier, the manager role can store meta_page_title or meta_page_favicon through /api/admin/system-…

▾ TwilightMintplex-Labs · anything-llmEPSS 0.20%via CVEORG