CVE-2026-88055 in AnythingLLM
Summary
by MITRE • 09/10/2026
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and earlier, the manager role can store meta_page_title or meta_page_favicon through /api/admin/system-preferences, and MetaGenerator inserts those values into production homepage HTML without escaping attribute values or text content. The values pass unchanged through server/models/systemSettings.js and reach MetaGenerator.generate() in server/index.js. #assembleMeta() in server/utils/boot/MetaGenerator.js concatenates the stored values into HTML. When an administrator visits the homepage /, injected JavaScript can read the administrator JWT and use it to create API keys, access or modify workspace and chat data, delete users, and perform other administrator actions. server/endpoints/admin.js accepts the manager-controlled settings before server/models/systemSettings.js returns them unchanged. No fixed version is available as of this review.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in AnythingLLM versions 1.16.1 and earlier represents a critical stored cross-site scripting (XSS) flaw rooted in insufficient input validation and output encoding within the application's administrative configuration interface. The core technical deficiency lies in how user-supplied data, specifically meta_page_title and meta_page_favicon fields controlled by users with manager privileges, is processed and rendered on the public-facing homepage. When these values are submitted via the /api/admin/system-preferences endpoint, they pass through server/models/systemSettings.js without sanitization or encoding checks. The system then forwards this untrusted data to MetaGenerator.generate() in server/index.js, where it is concatenated directly into HTML structure by the #assembleMeta function located in server/utils/boot/MetaGenerator.js. This architectural design fails to implement proper context-aware output encoding for attribute values and text content within the generated HTML head section, allowing arbitrary script injection that persists on the server side until manually cleared or overwritten.
The operational impact of this vulnerability is severe due to its stored nature and high-privilege execution context. Unlike reflected XSS attacks which require tricking a user into clicking a malicious link, this flaw allows an attacker with manager-level access to implant persistent malicious scripts in the homepage HTML. When any administrator subsequently visits the homepage at /, their browser executes the injected JavaScript payload within the security context of the application domain. This execution environment grants the script full access to sensitive client-side state, most notably the JSON Web Token (JWT) used for authentication and authorization. By extracting this token, an attacker can impersonate the administrative user session with high fidelity, bypassing standard web-based protections that rely on cookie or header validation without verifying token integrity against server-side sessions in real-time during script execution contexts.
The exploitation of this vulnerability enables a comprehensive compromise of application security and data integrity. Once the administrator JWT is harvested by the injected payload, it can be utilized to create new API keys, effectively granting persistent programmatic access that survives browser session closures or cookie expiration events. This capability allows for extensive lateral movement within the platform's ecosystem. The attacker gains the ability to read, modify, or delete workspace data and chat histories belonging to other users, leading to significant confidentiality breaches. Furthermore, the elevated privileges associated with the stolen JWT permit administrative actions such as deleting user accounts, altering system configurations, and potentially escalating further if additional privilege escalation vectors exist within the API layer. This transforms a seemingly minor configuration field into a potent vector for total account takeover and data exfiltration.
From a classification perspective, this vulnerability aligns closely with CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting), specifically in its stored variant where malicious content is saved on the target server and served to other users later. It also relates to CWE-601: URL Redirection to Untrusted Site via User-Supplied Input, as the favicon field often involves external resource loading which can be abused for phishing or further exploitation if not strictly validated against a whitelist of allowed domains. In terms of offensive security frameworks, this attack path corresponds to MITRE ATT&CK technique T1059: Command and Scripting Interpreter, where JavaScript is used to automate administrative tasks, and T1530: Data from Information Repositories, as the attacker accesses stored workspace data via the stolen credentials. The lack of input validation at ingestion time combined with the absence of output encoding during rendering creates a classic injection vulnerability pattern that undermines the trust boundary between user inputs and system outputs.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Since no fixed version is currently available, administrators should immediately restrict access to the /api/admin/system-preferences endpoint to only those users with verified super-administrator privileges rather than general managers, thereby reducing the attack surface for initial injection attempts. Implementing strict Content Security Policy (CSP) headers can significantly mitigate the impact of any successfully injected scripts by restricting the sources from which JavaScript can be executed and preventing unauthorized API key creation or data exfiltration via fetch requests. Additionally, developers must enforce rigorous input validation on all administrative configuration fields to reject non-string characters or potentially dangerous patterns in meta_page_title and favicon URLs. Crucially, output encoding must be applied consistently across all rendering layers; specifically, MetaGenerator.js should utilize context-aware escaping libraries that encode special HTML entities such as <, >, &, ", and ' before concatenating user data into the DOM structure. Regular security audits focusing on server-side template injection points are essential to prevent similar vulnerabilities in other parts of the application logic.