AnythingLLM Multiple CVEs
Date: 2026-03
Affected: AnythingLLM Multiple CVEs
Attack vector: rce
Category: real-world
Severity: Critical
CVE: CVE-2026-24477
CVE-2026-32617
CVE-2026-32626
CVE-2026-32719
CWE: CWE-1188
CWE-201
CWE-22
CWE-79
CWE-94
CWE-942
CVSS:  (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L)

Multiple vulnerabilities in AnythingLLM Desktop v1.11.1 and earlier: CVE-2026-32626 (CVSS 9.7) streaming phase XSS to RCE via LLM response injection in Electron; CVE-2026-32719 Zip Slip path traversal in plugin imports leading to arbitrary code execution; CVE-2026-32617 authentication bypass exposing HTTP/WebSocket endpoints; CVE-2026-24477 Qdrant API key exposed in plaintext via `/api/setup-complete`.


Mitigations:

Architectural layers (MAESTRO):