CVE-2024-8251

A vulnerability in mintplex-labs/anything-llm prior to version 1.2.2 allows for Prisma injection. The issue exists in the API endpoint "/embed/:embedId/stream-chat" where user-provided JSON is directly taken to the Prisma library's where clause. An attacker can exploit this by providing a specially crafted JSON object, such as {"sessionId":{"not":"a"}}, causing Prisma to return all data from the table. This can lead to unauthorized access to all user queries in embedded chat mode.

• CWE-89

• https://github.com/mintplex-labs/anything-llm/commit/334fd9cdd02ad4aa6a3c9bdfc95e7764651c13f4Patch
• https://huntr.com/bounties/7c263ef1-7d50-475a-9425-b15df4e0403cExploit, Third Party Advisory

Published

Mar 20, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-8245The GamiPress WordPress plugin before 1.0.1 does not have C…4.3
• CVE-2024-8246The Post Form – Registration Form – Profile Form for User Pr…8.8
• CVE-2024-8247The Newsletters plugin for WordPress is vulnerable to privil…8.8
• CVE-2024-8248A vulnerability in the normalizePath function in mintplex-la…7.2
• CVE-2024-8249mintplex-labs/anything-llm version git 6dc3642 contains an u…7.5
• CVE-2024-8250NTLMSSP dissector crash in Wireshark 4.2.0 to 4.0.6 and 4.0.…5.5
• CVE-2024-8252The Clean Login plugin for WordPress is vulnerable to Local …8.8
• CVE-2024-8253The Post Grid and Gutenberg Blocks plugin for WordPress is v…8.8
• CVE-2024-8254The Email Subscribers by Icegram Express – Email Marketing, …6.3
• CVE-2024-8255Delta Electronics DTN Soft version 2.0.1 and prior are vulne…9.8
• CVE-2024-8256In Teltonika Networks RUTOS devices, running on versions 7.0…5.9
• CVE-2024-8258Improper Control of Generation of Code ('Code Injection') in…7.8