CVE-2026-32626 - Vulnerability Analysis

Overview

AnythingLLM Desktop <= 1.11.1 contains a stored XSS caused by improper sanitization in the chat rendering pipeline, letting attackers execute remote code on the host OS via insecure Electron configuration, exploit requires normal chat usage.

Severity & Score

Impact

Attackers can execute remote code on the host OS, leading to full system compromise without user interaction beyond normal chat usage.

Mitigation

Update to a version later than 1.11.1 or apply proper sanitization and secure Electron configuration.

References

• https://github.com/Mintplex-Labs/anything-llm/commit/9e2d144dc8be6fab29f560f5bcdaa9ef7dbb4214
• https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-rrmw-2j6x-4mf2

Social Media Activity(1 post)

Offensive Sequence

@offseq

Mar 14, 2026

🚨 CRITICAL: CVE-2026-32626 in AnythingLLM Desktop ≤1.11.1 lets attackers run code via XSS → RCE (CVSS 9.7). No patch yet. Restrict chat, harden Electron, sanitize input. High risk, act now! More: https://radar.offseq.com/threat/cve-2026-32626-cwe-79-improper-neutralization-of-i-a50f3d86 #OffSeq #XSS #RCE #InfoSec

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner