CVE-2026-32626: Mintplexlabs AnythingLLM RCE Vulnerability

CVE-2026-32626 Overview

CVE-2026-32626 is a critical Cross-Site Scripting (XSS) vulnerability in AnythingLLM Desktop that escalates to Remote Code Execution (RCE) on the host operating system. AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In version 1.11.1 and earlier, the chat rendering pipeline contains a Streaming Phase XSS flaw due to insecure Electron configuration, allowing attackers to execute arbitrary code with no user interaction beyond normal chat usage.

The vulnerability exists because the custom markdown-it image renderer in frontend/src/utils/chat/markdown.js interpolates token.content directly into the alt attribute without HTML entity escaping. Additionally, the PromptReply component renders this output via dangerouslySetInnerHTML without DOMPurify sanitization—unlike HistoricalMessage which correctly applies DOMPurify.sanitize().

Critical Impact

This vulnerability enables attackers to achieve Remote Code Execution on the host operating system through XSS injection in the chat interface, working with default settings and requiring no additional user interaction beyond normal chat usage.

Affected Products

• Mintplexlabs AnythingLLM Desktop version 1.11.1 and earlier
• All AnythingLLM Desktop installations with default configurations

Discovery Timeline

• 2026-03-16 - CVE-2026-32626 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-32626

Vulnerability Analysis

This vulnerability represents a dangerous chain from Cross-Site Scripting to Remote Code Execution in an Electron-based desktop application. The core issue stems from inconsistent sanitization practices within AnythingLLM's frontend code. While the HistoricalMessage component properly sanitizes content using DOMPurify.sanitize(), the PromptReply component—responsible for rendering streaming LLM responses—bypasses this critical security control entirely.

When an attacker crafts malicious content that gets processed through the chat pipeline, the markdown rendering engine interpolates unsanitized user-controllable data directly into HTML attributes. Combined with Electron's insecure default configuration, this XSS vulnerability escalates to full Remote Code Execution on the underlying host operating system.

Root Cause

The root cause is a failure to apply consistent input sanitization across all rendering paths in the chat interface. The PromptReply component uses React's dangerouslySetInnerHTML to render markdown content without first passing it through DOMPurify sanitization. This creates a direct injection point where malicious JavaScript can be executed within the Electron application context, which has access to Node.js APIs and the host filesystem.

Attack Vector

The attack vector is network-based and requires minimal user interaction. An attacker can inject malicious payloads through LLM response content or manipulated chat data. Since the vulnerability works with default AnythingLLM Desktop settings, any user who views a crafted chat message during the streaming phase can have arbitrary code executed on their system. The insecure Electron configuration allows the XSS payload to break out of the browser sandbox and access native system functionality.

The security patch demonstrates the fix by importing and applying DOMPurify sanitization to the PromptReply component:

 import { memo, useRef, useEffect } from "react";
 import { Warning } from "@phosphor-icons/react";
 import renderMarkdown from "@/utils/chat/markdown";
+import DOMPurify from "@/utils/chat/purify";
 import Citations from "../Citation";
 import {
   THOUGHT_REGEX_CLOSE,

Source: GitHub Commit Details

Detection Methods for CVE-2026-32626

Indicators of Compromise

• Unusual JavaScript execution or process spawning from the AnythingLLM Desktop application
• Suspicious network connections originating from the Electron process
• Unexpected file system access or modifications by the AnythingLLM process
• Chat logs containing encoded or obfuscated script tags or event handlers

Detection Strategies

• Monitor for child processes spawned by the AnythingLLM Electron application that indicate RCE exploitation
• Implement endpoint detection rules for XSS-to-RCE patterns in Electron applications
• Review chat history data for malicious payloads containing JavaScript injection attempts
• Deploy behavioral analysis to detect abnormal AnythingLLM process activity

Monitoring Recommendations

• Enable enhanced logging for the AnythingLLM Desktop application to capture rendering events
• Configure EDR solutions to alert on suspicious behavior from Electron-based applications
• Monitor network traffic from AnythingLLM for unexpected outbound connections
• Implement file integrity monitoring for AnythingLLM installation directories

How to Mitigate CVE-2026-32626

Immediate Actions Required

• Update AnythingLLM Desktop to a version newer than 1.11.1 that includes the security patch
• Review chat history for any suspicious or malformed content that may indicate exploitation attempts
• Consider temporarily disabling external content sources until patching is complete
• Implement network segmentation to limit potential lateral movement if exploitation has occurred

Patch Information

Mintplex Labs has addressed this vulnerability in a security patch. The fix adds DOMPurify sanitization to the PromptReply component in frontend/src/components/WorkspaceChat/ChatContainer/ChatHistory/PromptReply/index.jsx, ensuring all markdown content is properly sanitized before rendering. Users should update to the latest version of AnythingLLM Desktop immediately.

For detailed patch information, see the GitHub Security Advisory and the GitHub Commit Details.

Workarounds

• Avoid using untrusted data sources or connecting to unknown LLM providers until patched
• Consider running AnythingLLM Desktop in an isolated virtual machine or container environment
• Disable or restrict network access for the AnythingLLM application where feasible
• Implement application whitelisting to prevent unauthorized code execution from the Electron process

# Verify AnythingLLM version and update
# Check current version in application settings
# Download latest release from official GitHub repository
# https://github.com/Mintplex-Labs/anything-llm/releases