Cross-Site Scripting Vulnerability in AnythingLLM by Mintplex Labs
CVE-2026-88055

5.5MEDIUM

Key Information:

Vendor

Mintplex-labs

Status
Anything-llm
Vendor
CVE Published:
10 September 2026

What is CVE-2026-88055?

The vulnerability present in AnythingLLM allows malicious JavaScript to be injected into the HTML rendered on the production homepage. This occurs due to inadequate validation of user-controlled settings by the manager role, where values such as meta_page_title or meta_page_favicon can be stored via the API. When these unescaped values are processed and concatenated into HTML, they expose the administrator JWT token, leading to unauthorized access. Attackers can manipulate administrative settings, delete users, and gain access to sensitive chat data, posing serious security risks until a fix is implemented.

Affected Version(s)

anything-llm <= 1.16.1

References

https://github.com/Mintplex-Labs/anything-llm/security/ad...
x_refsource_CONFIRM
https://github.com/Mintplex-Labs/anything-llm/commit/6dff...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.