CVE-2026-48116: AnythingLLM Command Injection via Ripgrep Abuse

Technical summary

The filesystem-search-files agent skill in AnythingLLM constructs ripgrep commands by inserting an LLM-controlled pattern parameter as a positional argument without using the -- end-of-options separator. ripgrep interprets arguments beginning with a hyphen as option flags rather than literal search patterns. An attacker can supply a pattern such as --pre=/bin/sh, which ripgrep then interprets as a preprocessor directive. This causes ripgrep to execute /bin/sh <file> for each file it encounters, effectively converting the search operation into arbitrary shell command execution. The vulnerability is particularly severe because the LLM intermediary may not recognize or block such injection patterns, and the attacker need only have chat access to a deployment with the filesystem plugin enabled—which is the default configuration in the official Docker image.

Business impact

Organizations running AnythingLLM in production with the filesystem plugin enabled face critical operational risk. An authenticated attacker can execute arbitrary commands within the AnythingLLM container, potentially leading to data exfiltration, lateral movement to other systems, deployment of malware or backdoors, or service disruption. The attack surface is broader than typical backend vulnerabilities because it can be triggered through the chat interface—any user or compromised account with chat access becomes a potential attack vector. In multi-tenant or shared deployments, this becomes a privilege escalation and isolation bypass. The combination with the file-writing skill means attackers can persist malicious code, create reverse shells, or modify application files.

Affected systems

AnythingLLM versions prior to 1.13.0 are affected. The official Docker image ships with the filesystem plugin enabled by default, making containerized deployments particularly vulnerable. Any installation that has enabled the filesystem-search-files and filesystem-write-text-file agent skills is at risk. Organizations should audit their deployments to identify which versions are currently running and whether the filesystem plugin is active.

Exploitability

The vulnerability requires authentication (PR:L in CVSS terms) and non-trivial understanding of ripgrep syntax and AnythingLLM's architecture, reflected in the AC:H (High Complexity) rating. However, once an attacker understands the injection mechanism, exploitation is straightforward and can be delivered through normal chat interaction without additional tools or user interaction. The barrier to exploitation is moderate—security research or documentation discovery of the ripgrep --pre flag behavior enables reliable attacks. LLM-mediated exploitation is possible if the model can be prompted or jailbroken to generate malicious search patterns, though this is less direct than manual exploitation.

Remediation

Upgrade AnythingLLM to version 1.13.0 or later, which implements proper input sanitization and uses the -- separator to prevent ripgrep from interpreting user-supplied patterns as option flags. Organizations unable to upgrade immediately should disable the filesystem plugin if not required for operations, or restrict chat access to trusted users only. Review access logs and chat histories for suspicious search patterns (those beginning with --, --pre, --filter, or similar ripgrep options) to identify potential exploitation attempts.

Patch guidance

Apply the official update to AnythingLLM 1.13.0 or newer. Verify the patch is applied by checking the application version in settings or logs. Test filesystem search functionality post-patch to ensure the fix does not break legitimate search operations. For Docker deployments, rebuild container images with the patched version and redeploy. Consider implementing a phased rollout to verify stability in non-production environments first.

Detection guidance

Monitor AnythingLLM logs and audit trails for chat messages containing ripgrep option-like patterns in filesystem search queries, particularly those beginning with --, --pre, --filter, --type, or other known ripgrep flags. Network detection is limited to behavioral indicators: unusual outbound connections or command execution initiated from the AnythingLLM container. Endpoint-level monitoring of the container runtime can detect unexpected child processes spawned by ripgrep or the AnythingLLM process. Alert on file modifications within the AnythingLLM container directory, especially creation of scripts or executables in temporary locations.

Why prioritize this

This vulnerability merits immediate attention despite authentication requirements because: (1) it enables complete remote code execution within production containers; (2) the default Docker configuration is vulnerable, affecting the most common deployment model; (3) the attack vector is accessible to any authenticated user, including those with limited intended privileges; (4) it chains with a sibling file-writing capability to create persistent compromise; (5) the fix is available and straightforward to deploy. Organizations should prioritize patching within their standard critical vulnerability timelines.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects the severity of remote code execution (High impact on confidentiality, integrity, and availability), balanced against the authentication requirement and moderate attack complexity. The score appropriately captures the risk in typical deployments but may underweight scenarios where chat access is broadly granted or where the service is internet-facing with weak authentication.

Frequently asked questions