AnythingLLM env-var update endpoint command injection -> RCE
Date: 2024-04
Affected: anything-llm < 1.0.0
Attack vector: command-injection
Category: real-world
Severity: Critical
CVE: CVE-2024-3104
CVSS: 9.8 ()

RCE in mintplex-labs/anything-llm < 1.0.0 via /api/system/update-env: insufficient sanitization allows attackers to inject env vars with newlines/quotes that break out of the assignment context and execute commands on the host.


Mitigations:

Architectural layers (MAESTRO):