PT-2025-12227 · Mintplex+1 · Anything-Llm+1

Published 2025-03-20 · Updated 2025-07-15 · CVE-2024-8251

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions mintplex-labs/anything-llm versions prior to 1.2.2

Description A vulnerability exists in the API endpoint "/embed/:embedId/stream-chat" where user-provided JSON is directly taken to the Prisma library's where clause. An attacker can exploit this by providing a specially crafted JSON object, such as {"sessionId":{"not":"a"}}, causing Prisma to return all data from the table. This can lead to unauthorized access to all user queries in embedded chat mode.

Recommendations For versions prior to 1.2.2, update to version 1.2.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/embed/:embedId/stream-chat" API endpoint until a patch is available. Avoid using user-provided JSON in the Prisma library's where clause to minimize the risk of exploitation.

Exploit

Fix

SQL injection

RCE

Weakness Enumeration

CWE-89

CWE-20

Related Identifiers

CVE-2024-8251

Affected Products

Prismax

Anything-Llm

References · 6

• 🔥 https://huntr.com/bounties/7c263ef1-7d50-475a-9425-b15df4e0403c · Exploit
• https://github.com/mintplex-labs/anything-llm/commit/334fd9cdd02ad4aa6a3c9bdfc95e7764651c13f4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-8251 · Security Note
• https://osv.dev/vulnerability/CVE-2024-8251 · Vendor Advisory
• https://t.me/cvenotify/129035 · Telegram Post
• https://twitter.com/CVEnew/status/1903336848904036482 · Twitter Post