AVID-2026-R1296

Description

SQL Injection in mintplex-labs/anything-llm (CVE-2023-4899)

Details

SQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.

Reason for inclusion in AVID: The CVE describes a SQL injection vulnerability (CWE-89) in an AI-related software project (mintplex-labs/anything-llm) that would be used in AI model deployment/serving pipelines. It affects the integrity and confidentiality of data, has CVSS high severity, and concerns software components used in building/running general-purpose AI systems (the artifact itself). The report provides explicit evidence (CVE, NVD entry, commit link) supporting this vulnerability in a software artifact central to AI stacks. Therefore it should be kept for AVID curation as a software supply chain vulnerability in AI systems.

References

Affected or Relevant Artifacts

Developer: mintplex-labs
Deployer: mintplex-labs
Artifact Details:

Type	Name
System	mintplex-labs/anything-llm

Impact

AVID Taxonomy Categorization

Risk domains: Security
SEP subcategories: S0100: Software Vulnerability
Lifecycle stages: L06: Deployment

CVSS

Version	3.0
Vector String	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Base Score	8.1
Base Severity	🔴 High
Attack Vector	NETWORK
Attack Complexity	🟢 Low
Privileges Required	🟢 Low
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	🔴 High
Integrity Impact	🔴 High
Availability Impact	NONE

CWE

ID	Description
CWE-89	CWE-89 Improper Neutralization of Special Elements used in an SQL Command

Other information

Report Type: Advisory
Credits:
Date Reported: 2023-09-11
Version: 0.3.3
AVID Entry