PT-2026-25382 · Unknown+1 · Mysql Server+3

Aviral2642 · Published 2026-03-13 · Updated 2026-03-26 · CVE-2026-32628

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions AnythingLLM versions 1.11.1 and earlier

Description AnythingLLM is an application designed to provide context from content pieces for use with Large Language Models (LLMs). A SQL injection issue exists within the built-in SQL Agent plugin. This allows users who can invoke the agent to execute arbitrary SQL commands on connected databases. The getTableSchemaSql() method in the MySQL, PostgreSQL, and MSSQL database connectors constructs SQL queries by directly concatenating the table name parameter without proper sanitization or parameterization.

Recommendations Versions prior to 1.11.1 should be updated.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2026-04255

CVE-2026-32628

GHSA-JWJX-MW2P-5WC7

Affected Products

Anything-Llm

Mssql

Mysql Server

Postgresql

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32628.json · Exploit
• https://github.com/Mintplex-Labs/anything-llm/commit/334ce052f063b53a4275518cbed3bab357695d7e · Patch
• https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-jwjx-mw2p-5wc7 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04255 · Security Note
• https://osv.dev/vulnerability/CVE-2026-32628 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32628 · Security Note
• https://t.me/CVEtracker/47375 · Telegram Post
• https://twitter.com/DarFazulyanov/status/2037209895838376109 · Twitter Post
• https://twitter.com/CVEnew/status/2032605837798101050 · Twitter Post
• https://twitter.com/hackernoon/status/2037103043724853670 · Twitter Post