CVE-2024-3166
CriticalCVSS 9.6Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. This vulnerability allows for the execution of arbitrary JavaScript code by embedding content from external websites.
Risk Assessment
The risk to the organization involves the potential execution of malicious code, which could lead to serious security breaches, including Remote Code Execution (RCE) in the desktop application.
Recommendation
It is recommended to update the desktop application to version 1.4.2 to mitigate this vulnerability and to review the application's security settings, including disabling 'nodeIntegration' and enabling 'contextIsolation'.
Original NVD description (English source)
A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to fetch and embed content from websites into workspaces, which can be exploited to execute arbitrary JavaScript code. In the desktop application, this flaw can be escalated to Remote Code Execution (RCE) due to insecure application settings, specifically the enabling of 'nodeIntegration' and the disabling of 'contextIsolation' in Electron's webPreferences. The issue has been addressed in version 1.4.2 of the desktop application.