A vulnerability in mintplex-labs/anything-llm prior to version 1.2.2 allows for Prisma injection. The issue exists in the API endpoint "/embed/:embedId/stream-chat" where user-provided JSON is directly taken to the Prisma library's where clause. An attacker can exploit this by providing a specially crafted JSON object, such as {"sessionId":{"not":"a"}}, causing Prisma to return all data from the table. This can lead to unauthorized access to all user queries in embedded chat mode.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/mintplex-labs/anything-llm/commit/334fd9cdd02ad4aa6a3c9bdfc95e7764651c13f4 | Patch |
| https://huntr.com/bounties/7c263ef1-7d50-475a-9425-b15df4e0403c | Exploit Third Party Advisory |
Configurations
History
15 Jul 2025, 15:19
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://huntr.com/bounties/7c263ef1-7d50-475a-9425-b15df4e0403c - Exploit, Third Party Advisory | |
| References | () https://github.com/mintplex-labs/anything-llm/commit/334fd9cdd02ad4aa6a3c9bdfc95e7764651c13f4 - Patch | |
| First Time |
Mintplexlabs anythingllm
Mintplexlabs |
|
| CPE | cpe:2.3:a:mintplexlabs:anythingllm:*:*:*:*:*:*:*:* |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-15 15:19
NVD link : CVE-2024-8251
Mitre link : CVE-2024-8251
JSON object : View
Products Affected
mintplexlabs
- anythingllm
CWE
CWE-20
Improper Input Validation