CVE-2026-32628— AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-32628
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AnythingLLM has SQL Injection in Built-in SQL Agent Plugin via Unsanitized table_name Parameter
Source: NVD (National Vulnerability Database)
Vulnerability Description
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.11.1 and earlier, a SQL injection vulnerability in the built-in SQL Agent plugin allows any user who can invoke the agent to execute arbitrary SQL commands on connected databases. The getTableSchemaSql() method in all three database connectors (MySQL, PostgreSQL, MSSQL) constructs SQL queries using direct string concatenation of the table_name parameter without sanitization or parameterization.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: NVD (National Vulnerability Database)
Vulnerability Title
AnythingLLM SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
AnythingLLM是Mintplex开源的一个一体化AI应用程序。 AnythingLLM 1.11.1及之前版本存在SQL注入漏洞，该漏洞源于内置SQL代理插件中存在SQL注入漏洞，任何可以调用代理的用户都可能对连接的数据库执行任意SQL命令，三个数据库连接器的getTableSchemaSql方法使用未经清理或参数化的table_name参数直接字符串拼接构造SQL查询。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Mintplex-Labs | anything-llm | <= 1.11.1 | - |
II. Public POCs for CVE-2026-32628
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-32628
请登录查看更多情报信息。
Same Patch Batch · Mintplex-Labs · 2026-03-13 · 6 CVEs total
| CVE-2026-32626 | 9.7 CRITICAL | AnythingLLM has a Streaming Phase XSS to RCE via LLM Response Injection |
| CVE-2026-32617 | 7.1 HIGH | AnythingLLM Permissable CORS policy |
| CVE-2026-32719 | 4.2 MEDIUM | AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Impo |
| CVE-2026-32715 | 3.8 LOW | AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences |
| CVE-2026-32717 | 2.7 LOW | AnythingLLM access control bypass: suspended users can continue using Browser Extension AP |
IV. Related Vulnerabilities
Same product: anything-llm
- CVE-2026-42456
AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (ID - CVE-2026-41318
AnythingLLM vulnerable to stored DOM XSS in chart caption re - CVE-2026-32719
AnythingLLM has a Zip Slip Path Traversal and Code Execution - CVE-2026-32717
AnythingLLM access control bypass: suspended users can conti - CVE-2026-32715
AnythingLLM Manager Privilege Bypass Allows Access to Admin-
Same vendor: Mintplex-Labs
- CVE-2026-42456
AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (ID - CVE-2026-41318
AnythingLLM vulnerable to stored DOM XSS in chart caption re - CVE-2026-5627
Path Traversal in mintplex-labs/anything-llm - CVE-2026-32719
AnythingLLM has a Zip Slip Path Traversal and Code Execution - CVE-2026-32717
AnythingLLM access control bypass: suspended users can conti
Same weakness: CWE-89
- CVE-2021-47941
WordPress Plugin Survey & Poll 1.5.7.3 SQL Injection via sss - CVE-2021-47930
Balbooa Joomla Forms Builder 2.0.6 SQL Injection Unauthentic - CVE-2021-47928
Opencart TMD Vendor System 3.x Blind SQL Injection via produ - CVE-2026-8231
CodeAstro Online Catering Ordering System deleteorder.php sq - CVE-2025-14179
SQL injection in pdo_firebird via NUL bytes in quoted string
V. Comments for CVE-2026-32628
No comments yet