CVE-2024-3166: Mintplexlabs Anythingllm Desktop remote code execution (CVSS 9.6)

Description

A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to fetch and embed content from websites into workspaces, which can be exploited to execute arbitrary JavaScript code. In the desktop application, this flaw can be escalated to Remote Code Execution (RCE) due to insecure application settings, specifically the enabling of 'nodeIntegration' and the disabling of 'contextIsolation' in Electron's webPreferences. The issue has been addressed in version 1.4.2 of the desktop application.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeChanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

Mintplexlabs Anythingllm Desktop< 1.4.2

Mintplexlabs Anythingllm Docker≤ 1.2.0

Remediation

Fixed in

Mintplexlabs Anythingllm Desktop≥ 1.4.2

Patch & vendor advisories

https://github.com/mintplex-labs/anything-llm/commit/fa27103d032c58904c49b92ee13fabc19a20a5ce

References

https://github.com/mintplex-labs/anything-llm/commit/fa27103d032c58904c49b92ee13fabc19a20a5cePatch
https://huntr.com/bounties/af288bd3-8824-4216-a294-ae9fb444e5dbExploitThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2024-3166 being actively exploited?

CVE-2024-3166 is not in the CISA KEV catalog. A public exploit reference exists, so treat it as exploitable. Its EPSS exploit probability is 0.97%.

How severe is CVE-2024-3166?

CVE-2024-3166 has a CVSS 3.1 base score of 9.6, rated critical. EPSS estimates a 0.97% probability of exploitation.

Which products are affected by CVE-2024-3166?

Affected products include Mintplexlabs Anythingllm Desktop, Mintplexlabs Anythingllm Docker.

How do I fix CVE-2024-3166?

Upgrade affected software to a fixed version, for example Mintplexlabs Anythingllm Desktop 1.4.2 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-3166 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo