CVE-2026-32628
Last modified
CVE-2026-32628 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, a SQL injection vulnerability in the built-in SQL Agent plugin allows any user who can invoke the agent to execute arbitrary SQL commands on connected databases. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, a SQL injection vulnerability in the built-in SQL Agent plugin allows any user who can invoke the agent to execute arbitrary SQL commands on connected databases. The getTableSchemaSql() method in all three database connectors (MySQL, PostgreSQL, MSSQL) constructs SQL queries using direct string concatenation of the table_name parameter without sanitization or parameterization.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mintplexlabs | Anythingllm | <= 1.11.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-32628?
How severe is CVE-2026-32628?
How do I fix CVE-2026-32628?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-32622SQLBot is an intelligent data query system based on a large …8.8
- CVE-2026-32623xrdp is an open source RDP server. Versions through 0.10.5 c…8.1
- CVE-2026-32624xrdp is an open source RDP server. Versions through 0.10.5 c…6.5
- CVE-2026-32625LibreChat is an enhanced ChatGPT clone that supports multipl…9.6
- CVE-2026-32626AnythingLLM is an application that turns pieces of content i…9.6
- CVE-2026-32627cpp-httplib is a C++11 single-file header-only cross platfor…8.1
- CVE-2026-32629phpMyFAQ is an open source FAQ web application. Prior to ver…6.1
- CVE-2026-3263A vulnerability was found in go2ismail Asp.Net-Core-Inventor…8.8
- CVE-2026-32630file-type detects the file type of a file, stream, or data. …5.3
- CVE-2026-32631Git for Windows is the Windows port of Git. Versions prior t…7.4
- CVE-2026-32632Glances is an open-source system cross-platform monitoring t…5.9
- CVE-2026-32633Glances is an open-source system cross-platform monitoring t…9.1
Are you affected by CVE-2026-32628?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST