CVE-2024-3166: A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop ap

Q: How do I fix CVE-2024-3166?

anythingllm desktop: upgrade to 1.4.2; anythingllm docker: upgrade to newer than 1.2.0. Exact commands for each OS are on this page.

Q: Is CVE-2024-3166 being exploited?

CVE-2024-3166 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2024-3166 affect?

CVE-2024-3166 affects anythingllm desktop, anythingllm docker. Severity is critical (CVSS 9.6). A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to

Q: How urgent is CVE-2024-3166?

Priority 59/100. Critical severity; Public exploit reference; On your watchlist

This month

CRITICAL 9.6WATCHLISTUPGRADEUPGRADE

CVE-2024-3166 is a critical-severity flaw (CVSS 9.6) affecting anythingllm desktop, anythingllm docker. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to fetch and embed content from websites into workspaces, which can be exploited to execute arbitrary JavaScript code. In the desktop application, this flaw can be escalated to Remote Code Execution (RCE) due to i

Why this priority

Critical severity
Public exploit reference
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	9.6 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	Required
EPSS exploit chance	1.0% (top 38%)
CISA exploited list	No
Weakness	CWE-79
Published	2024-06-06
Last modified	2026-06-17

Publisher (CNA): huntr.dev · Vendor: mintplexlabs

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2024-06-06 19:16 UTCPublished CVE record published
2026-06-17 19:09 UTCUpdated Record last modified

mintplexlabs anythingllm desktop UPGRADE

Affected: < 1.4.2

Fixed in: 1.4.2

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy anythingllm-desktop || rpm -q anythingllm-desktop || anythingllm-desktop --version

2. UPGRADE to 1.4.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade anythingllm-desktop

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade anythingllm-desktop

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

mintplexlabs anythingllm docker UPGRADE

Affected: <= 1.2.0

Fixed in: newer than 1.2.0

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy anythingllm-docker || rpm -q anythingllm-docker || anythingllm-docker --version

2. UPGRADE to newer than 1.2.0 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade anythingllm-docker

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade anythingllm-docker

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2024-3166?

anythingllm desktop: upgrade to 1.4.2; anythingllm docker: upgrade to newer than 1.2.0. Exact commands for each OS are on this page.

Is CVE-2024-3166 being exploited?

CVE-2024-3166 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2024-3166 affect?

CVE-2024-3166 affects anythingllm desktop, anythingllm docker. Severity is critical (CVSS 9.6). A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to

How urgent is CVE-2024-3166?

Priority 59/100. Critical severity; Public exploit reference; On your watchlist

Software pages

Docker vulnerabilities

Related CVEs

CVE-2024-8196 CRITICAL 9.8 UPGRADE In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0

References

← Back to latest CVEs