Remote Code Execution Vulnerability in anything-llm Could Lead to Code Execution and Data Modification

CVE-2024-3104

Summary

A vulnerability exists in Anything-LLM from Mintplex Labs due to improper handling of environment variables, specifically in the /api/system/update-env endpoint. Attackers can exploit this weakness to inject arbitrary environment variables, potentially leading to the execution of arbitrary code on the host system running Anything-LLM. This vulnerability is present in the latest version of the product, as identified by commit fde905aac1812b84066ff72e5f2f90b56d4c3a59. Successful exploitation may allow attackers to read and modify data accessible to the user operating the service, which could result in wider security implications including denial of service. The issue has been resolved in version 1.0.0.

References