Executive Summary

The vulnerability exists in AnythingLLM versions prior to 1.13.0 in the filesystem-search-files agent skill. This skill passes a pattern parameter controlled by the language model (LLM) directly to the ripgrep tool as a positional argument without using an end-of-options separator (--). Because ripgrep interprets any argument starting with a dash (-) as an option, an attacker can craft a pattern like "--pre=/bin/sh" which causes ripgrep to execute the /bin/sh shell for every file it processes. This allows an attacker who can interact with the agent on a deployment with the filesystem plugin enabled to execute arbitrary commands inside the AnythingLLM server container.

The vulnerability is fixed in version 1.13.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute arbitrary commands inside the AnythingLLM server container if they can interact with the agent and the filesystem plugin is enabled. This can lead to full compromise of the server environment, including unauthorized access, data manipulation, or disruption of services.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade AnythingLLM to version 1.13.0 or later, where the issue has been fixed.

Additionally, if you are running the official Docker image with the filesystem plugin enabled, consider disabling or restricting access to the filesystem-search-files agent skill and the filesystem-write-text-file skill to prevent attackers from exploiting this command execution vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability CVE-2026-48116 allows an attacker with agent access to execute arbitrary commands inside the AnythingLLM server container. This can lead to unauthorized access and potential compromise of sensitive data and services within the container.

Such unauthorized access and potential data compromise could negatively impact compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and prevention of unauthorized system access.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the filesystem-search-files agent skill passing an LLM-controlled pattern parameter to ripgrep without proper argument separation, allowing command injection. Detection involves checking if the AnythingLLM application version is prior to 1.13.0 and if the filesystem plugin is enabled.

To detect exploitation attempts or presence of this vulnerability, you can monitor for unusual ripgrep command executions with patterns starting with hyphens (e.g., "--pre=/bin/sh") or unexpected shell executions within the AnythingLLM server container.

Suggested commands to help detect potential exploitation attempts include:

• Check the AnythingLLM version installed: `anythingllm --version` or check the Docker image tag.
• Search for suspicious ripgrep processes with arguments starting with hyphens: `ps aux | grep rg` or `ps aux | grep ripgrep` and inspect the command line for patterns like "--pre=/bin/sh".
• Monitor logs for filesystem-search-files agent skill usage or any commands invoking ripgrep with unusual parameters.
• Audit files created or modified by the filesystem-write-text-file skill for unexpected scripts or commands.
• Use container runtime security tools to detect shell executions or command injections inside the AnythingLLM server container.

Useful 0 Not Useful 0