CVE-2026-48116— AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill

AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to 1.13.0, the filesystem-search-files agent skill passes its LLM-controlled pattern parameter to ripgrep as a positional argument without a -- end-of-options separator. ripgrep parses any argument that starts with - as an option, so a pattern of --pre=/bin/sh turns ripgrep into a script executor: it runs /bin/sh <file> for every file it walks. An attacker who can chat with an agent on a deployment with the filesystem plugin enabled (the default in the official Docker image) can use this, together with the sibling filesystem-write-text-file skill, to run arbitrary commands inside the AnythingLLM server container. This vulnerability is fixed in 1.13.0.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

在命令中使用的特殊元素转义处理不恰当(命令注入)

AnythingLLM 参数注入漏洞

AnythingLLM是Mintplex开源的一个一体化AI应用程序。 AnythingLLM 1.13.0之前版本存在参数注入漏洞，该漏洞源于filesystem-search-files代理技能将LLM控制的模式参数直接传递给ripgrep作为位置参数，未使用--结束选项分隔符，导致攻击者可以通过聊天与代理交互，利用filesystem插件（官方Docker镜像中默认启用）和兄弟技能filesystem-write-text-file，在AnythingLLM服务器容器内运行任意命令。

N/A

N/A