AnythingLLMPublished 20 Mar 2025NVD status: Analyzed

CVE-2024-10109

AnythingLLM: A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models".

ComponentAnythingLLM
Severityhigh (CVSS 8.3)
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Published (NVD)2025-03-20
Last modified2026-06-17
Affected versions
< 1.3.1
from the CVE Program record written by the CNA that assigned the CVE
Fixed in1.3.1
WeaknessCWE-863
CISA KEVnot listed

NVD description

A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access enables them to modify the model's API key and base path, leading to potential API key leakage and denial of service on chats.

What to do

  • Upgrade AnythingLLM to 1.3.1 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources