TI-2024-02907 Aliases CVE-2024-3104 GHSA-xcfw-58w2-3rxx

Remote Code Execution in mintplex-labs/anything-llm

HIGH 76CWE-78Published 2024-06-06 · Updated 2024-08-01

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulnerability by injecting arbitrary environment variables via the `POST /api/system/update-env` endpoint, which allows for the execution of arbitrary code on the host running anything-llm. The vulnerability is present in the latest version of anything-llm, with the latest commit identified as fde905aac1812b84066ff72e5f2f90b56d4c3a59. This issue has been fixed in version 1.0.0. Successful exploitation could lead to code execution on the host, enabling attackers to read and modify data accessible to the user running the service, potentially leading to a denial of service.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00978 62nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed mintplex-labs/anything-llm (mintplex-labs): 1.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
mintplex-labs	mintplex-labs/anything-llm	before 1.0.0	1.0.0	Patch available	CNA

mintplex-labs/anything-llm Vendormintplex-labs Affected before 1.0.0 Fixed in 1.0.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:mintplexlabs:anythingllm::::::::	before 1.0.0	Vulnerable	mintplex-labs

cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:* Versions before 1.0.0 Vulnerable ·mintplex-labs

Remediation

Fix · CNA mintplex-labs/anything-llm (mintplex-labs) Fixed in 1.0.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2024-06-06
mintplex-labs/anything-llm 1.0.0
8 records Highest priority Priority HIGH 6 HIGH, 2 MEDIUM
Other records, highest priority first
- TI-2024-02840 Improper Authorization in mintplex-labs/anything-llmPriority HIGH 82
- TI-2024-02952 Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llmPriority HIGH 73
- TI-2024-02950 Privilege Escalation in mintplex-labs/anything-llmPriority HIGH 73
Show all 8 records →

Timeline

2026-10-02 Threatist record created from CVE-2024-3104
2026-10-03 Alias added: GHSA-xcfw-58w2-3rxx

References

Exploit 1

https://huntr.com/bounties/4f2fcb45-5828-4bec-985a-9d3a0ee00462

Patch 1

https://github.com/mintplex-labs/anything-llm/commit/bfedfebfab032e6f4d5a369c8a2f947c5d0c5286

TI-2024-02840 Improper Authorization in mintplex-labs/anything-llm CVSS 3.1CRITICAL 9.4
TI-2024-03075 Improper Access Control in mintplex-labs/anything-llm CVSS 3.0CRITICAL 9.1
TI-2023-05368 Improper Input Validation in mintplex-labs/anything-llm CVSS 3.1CRITICAL 9.1
TI-2026-19731 AnythingLLM has key leak in `systemSettings.js` CVSS 4.0HIGH 8.7
TI-2024-02832 Path Traversal in mintplex-labs/anything-llm CVSS 3.0CRITICAL 9.9
TI-2023-04508 Relative Path Traversal in mintplex-labs/anything-llm CVSS 3.1CRITICAL 9.8

See all 66 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences