PT-2026-25382 · Unknown+1 · Mysql Server+3

Aviral2642 · Publicado 2026-03-13 · Atualizado 2026-03-26 · CVE-2026-32628

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AnythingLLM versions 1.11.1 and earlier

Description AnythingLLM is an application designed to provide context from content pieces for use with Large Language Models (LLMs). A SQL injection issue exists within the built-in SQL Agent plugin. This allows users who can invoke the agent to execute arbitrary SQL commands on connected databases. The getTableSchemaSql() method in the MySQL, PostgreSQL, and MSSQL database connectors constructs SQL queries by directly concatenating the table name parameter without proper sanitization or parameterization.

Recommendations Versions prior to 1.11.1 should be updated.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2026-04255

CVE-2026-32628

GHSA-JWJX-MW2P-5WC7

Produtos afetados

Anything-Llm

Mssql

Mysql Server

Postgresql

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32628.json · Exploit
• https://github.com/Mintplex-Labs/anything-llm/commit/334ce052f063b53a4275518cbed3bab357695d7e · Correção
• https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-jwjx-mw2p-5wc7 · Aviso do Fabricante
• https://t.me/CVEtracker/47375 · Publicação no Telegram
• https://twitter.com/DarFazulyanov/status/2037209895838376109 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2026-04255 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-32628 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-32628 · Nota de Segurança
• https://twitter.com/CVEnew/status/2032605837798101050 · Publicação no Twitter
• https://twitter.com/hackernoon/status/2037103043724853670 · Publicação no Twitter