CVE-2024-3166

A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to fetch and embed content from websites into workspaces, which can be exploited to execute arbitrary JavaScript code. In the desktop application, this flaw can be escalated to Remote Code Execution (RCE) due to insecure application settings, specifically the enabling of 'nodeIntegration' and the disabling of 'contextIsolation' in Electron's webPreferences. The issue has been addressed in version 1.4.2 of the desktop application.

• CWE-79

• https://github.com/mintplex-labs/anything-llm/commit/fa27103d032c58904c49b92ee13fabc19a20a5cePatch
• https://huntr.com/bounties/af288bd3-8824-4216-a294-ae9fb444e5dbExploit, Third Party Advisory
• https://github.com/mintplex-labs/anything-llm/commit/fa27103d032c58904c49b92ee13fabc19a20a5cePatch
• https://huntr.com/bounties/af288bd3-8824-4216-a294-ae9fb444e5dbExploit, Third Party Advisory

Published

Jun 6, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-31648Cross Site Scripting (XSS) in Insurance Management System v1…6.1
• CVE-2024-31649A cross-site scripting (XSS) in Cosmetics and Beauty Product…5.4
• CVE-2024-3165System->Maintenance-> Log Files in dotCMS dashboard is provi…4.5
• CVE-2024-31650A cross-site scripting (XSS) in Cosmetics and Beauty Product…9.6
• CVE-2024-31651A cross-site scripting (XSS) in Cosmetics and Beauty Product…6.1
• CVE-2024-31652A cross-site scripting (XSS) in Cosmetics and Beauty Product…6.1
• CVE-2024-31666An issue in flusity-CMS v.2.33 allows a remote attacker to e…9.8
• CVE-2024-31668rizin before v0.6.3 is vulnerable to Improper Neutralization…9.1
• CVE-2024-31669rizin before Release v0.6.3 is vulnerable to Uncontrolled Re…7.5
• CVE-2024-3167The Ocean Extra plugin for WordPress is vulnerable to Stored…6.4
• CVE-2024-31670rizin before v0.6.3 is vulnerable to Buffer Overflow via cre…6.3
• CVE-2024-31673Kliqqi-CMS 2.0.2 is vulnerable to SQL Injection in load_data…9.8