How many CVEs have a located fix in mintplex-labs/anything-llm?

69 published CVEs have a fix traced to functions in mintplex-labs/anything-llm, touching 155 functions across 114 files.

Which function in mintplex-labs/anything-llm has been patched by the most CVEs?

systemEndpoints in server/endpoints/system.js has been changed by 19 CVE fixes, from 2023 to 2026.

How large is a typical CVE fix in mintplex-labs/anything-llm?

The median fix changes 23 lines. 45% of fixes change 20 lines or fewer, and 29% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

javascript

python

#57 of 500 repositories

mintplex-labs/anything-llm

Name: mintplex-labs/anything-llm: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix September 10, 2026

69

CVE fixes located

Published CVEs

155

Functions patched

Distinct function sites

114

Files patched

Distinct source files

2023–2026

Years covered

By CVE publication date

Overview

69 published CVEs have a fix traced to functions in mintplex-labs/anything-llm, the earliest published in 2023. Those fixes changed 155 distinct functions across 114 files, in 1,002 patch hunks.

Among the 500 repositories tracked here, mintplex-labs/anything-llm ranks #57 by the number of CVEs with a located fix.

Most patched functions

Functions in mintplex-labs/anything-llm changed by the most CVE fixes.

Most patched files

Files in mintplex-labs/anything-llm changed by the most CVE fixes.

1server/endpoints/system.js27 CVEs · 6 functions
2server/endpoints/workspaces.js8 CVEs · 3 functions
3server/endpoints/admin.js7 CVEs · 4 functions
4server/models/systemSettings.js7 CVEs · 2 functions
5server/utils/helpers/updateENV.js6 CVEs · 5 functions
6frontend/src/components/SettingsSidebar/index.jsx6 CVEs · 2 functions
7server/index.js6 CVEs · 1 functions
8server/models/user.js6 CVEs · 0 functions
9server/endpoints/api/admin/index.js5 CVEs · 2 functions
10frontend/src/App.jsx5 CVEs · 1 functions

Fix size

How much code a CVE fix in mintplex-labs/anything-llm changes, with backports counted once.

23

Median lines changed

Added plus removed, per CVE

45%

Fixes of 20 lines or fewer

Share of CVE fixes

29%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in mintplex-labs/anything-llm, and the functions each fix changed.

AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator
CVE-2026-88055replace MetaGenerator
Medium · CVSS 5.5
EPSS 0.3%2026-09-10
AnythingLLM: Password recovery accepts one recovery code twice after whitespace normalization
CVE-2026-72917map
Medium · CVSS 5.9
EPSS 0.3%2026-08-10
AnythingLLM: embed-parsed-file cleanup deletes any parsed file by ID without ownership scoping (cross-tenant IDOR deletion)
CVE-2026-55611workspaceParsedFilesEndpoints AWSBedrockLLM
High · CVSS 7.1
EPSS 0.4%2026-06-24
AnythingLLM: Legacy mobile device tokens bypass multi-user workspace scoping after mode migration
CVE-2026-47713systemEndpoints
Medium · CVSS 4.3
EPSS 0.3%2026-05-28
AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill
CVE-2026-48116searchWithRipgrep searchFilesWithRipgrepGlob
High · CVSS 8.8
EPSS 0.5%2026-05-28
AnythingLLM: filesystem-copy-file follows nested symlinks and copies files from outside the allowed directory
CVE-2026-45403copyRecursive
Low · CVSS 2.5
EPSS 0.2%2026-05-28
AnythingLLM: Cross-User TTS Audio Disclosure via Chat ID (IDOR)
CVE-2026-42456workspaceEndpoints
Medium · CVSS 4.3
EPSS 0.3%2026-05-08
AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTML via unsanitized renderMarkdown(content.caption) in Chartable component
CVE-2026-41318Chartable
Medium · CVSS 5.4
EPSS 0.3%2026-04-24
Path Traversal in mintplex-labs/anything-llm
CVE-2026-5627isWithin AgentFlows
High · CVSS 7.2
EPSS 1.1%2026-04-07
AnythingLLM has a Zip Slip Path Traversal and Code Execution via Community Hub Plugin Import
CVE-2026-32719ImportedPlugin
Medium · CVSS 6.4
EPSS 0.5%2026-03-13
AnythingLLM access control bypass: suspended users can continue using Browser Extension API keys
CVE-2026-32717validBrowserExtensionApiKey adminEndpoints
Low · CVSS 2.7
EPSS 0.3%2026-03-13
AnythingLLM Manager Privilege Bypass Allows Access to Admin-Only System Preferences
CVE-2026-32715async includes
Low · CVSS 3.8
EPSS 0.3%2026-03-13

Get an alert for each new mintplex-labs/anything-llm CVE, with the patched functions and AI-written analysis.

Monitor anything-llm CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

ImageMagick/ImageMagick671 CVEs open-webui/open-webui71 CVEs glpi-project/glpi67 CVEs siyuan-note/siyuan67 CVEs FasterXML/jackson-databind72 CVEs python-pillow/Pillow66 CVEs apache/camel73 CVEs bcgit/bc-java73 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in mintplex-labs/anything-llm.

How many CVEs have a located fix in mintplex-labs/anything-llm?: 69 published CVEs have a fix traced to functions in mintplex-labs/anything-llm, touching 155 functions across 114 files.
Which function in mintplex-labs/anything-llm has been patched by the most CVEs?: systemEndpoints in server/endpoints/system.js has been changed by 19 CVE fixes, from 2023 to 2026.
How large is a typical CVE fix in mintplex-labs/anything-llm?: The median fix changes 23 lines. 45% of fixes change 20 lines or fewer, and 29% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track mintplex-labs/anything-llm CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing