PT-2025-12226 · Mintplex · Anything-Llm

Published 2025-03-20 · Updated 2025-07-15 · CVE-2024-8249

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm version git 6dc3642 through version prior to 1.2.2

Description The issue is related to an unauthenticated Denial of Service (DoS) vulnerability in the API for the embeddable chat functionality. An attacker can exploit this by sending a malformed JSON payload to the API endpoint, causing a server crash due to an uncaught exception.

Recommendations For versions prior to 1.2.2, update to version 1.2.2 to resolve the issue. As a temporary workaround, consider restricting access to the API endpoint to minimize the risk of exploitation.

Exploit

Fix

DoS

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2024-8249

Affected Products

Anything-Llm

References · 6

• 🔥 https://huntr.com/bounties/2fb0c93f-5bc1-4212-bdca-292db7c6951f · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/548da9ade30368289c5beaf0a8ee2ed2b5c1d81c · Patch
• https://osv.dev/vulnerability/CVE-2024-8249 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8249 · Security Note
• https://t.me/cvenotify/129034 · Telegram Post
• https://twitter.com/CVEnew/status/1902968881062481949 · Twitter Post