CVE-2026-48116
Arbitrary Command Execution in AnythingLLM via ripgrep Pattern Injection
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| anythingllm | anythingllm | to 1.13.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
| CWE-88 | The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in AnythingLLM versions prior to 1.13.0 in the filesystem-search-files agent skill. This skill passes a pattern parameter controlled by the language model (LLM) directly to the ripgrep tool as a positional argument without using an end-of-options separator (--). Because ripgrep interprets any argument starting with a dash (-) as an option, an attacker can craft a pattern like "--pre=/bin/sh" which causes ripgrep to execute the /bin/sh shell for every file it processes. This allows an attacker who can interact with the agent on a deployment with the filesystem plugin enabled to execute arbitrary commands inside the AnythingLLM server container.
The vulnerability is fixed in version 1.13.0.
How can this vulnerability impact me? :
This vulnerability allows an attacker to execute arbitrary commands inside the AnythingLLM server container if they can interact with the agent and the filesystem plugin is enabled. This can lead to full compromise of the server environment, including unauthorized access, data manipulation, or disruption of services.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade AnythingLLM to version 1.13.0 or later, where the issue has been fixed.
Additionally, if you are running the official Docker image with the filesystem plugin enabled, consider disabling or restricting access to the filesystem-search-files agent skill and the filesystem-write-text-file skill to prevent attackers from exploiting this command execution vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability CVE-2026-48116 allows an attacker with agent access to execute arbitrary commands inside the AnythingLLM server container. This can lead to unauthorized access and potential compromise of sensitive data and services within the container.
Such unauthorized access and potential data compromise could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and prevention of unauthorized system access.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves the filesystem-search-files agent skill passing an LLM-controlled pattern parameter to ripgrep without proper argument separation, allowing command injection. Detection involves checking if the AnythingLLM application version is prior to 1.13.0 and if the filesystem plugin is enabled.
To detect exploitation attempts or presence of this vulnerability, you can monitor for unusual ripgrep command executions with patterns starting with hyphens (e.g., "--pre=/bin/sh") or unexpected shell executions within the AnythingLLM server container.
Suggested commands to help detect potential exploitation attempts include:
- Check the AnythingLLM version installed: `anythingllm --version` or check the Docker image tag.
- Search for suspicious ripgrep processes with arguments starting with hyphens: `ps aux | grep rg` or `ps aux | grep ripgrep` and inspect the command line for patterns like "--pre=/bin/sh".
- Monitor logs for filesystem-search-files agent skill usage or any commands invoking ripgrep with unusual parameters.
- Audit files created or modified by the filesystem-write-text-file skill for unexpected scripts or commands.
- Use container runtime security tools to detect shell executions or command injections inside the AnythingLLM server container.