CVE-2026-48116: AnythingLLM: RCE via ripgrep --pre argument injection in filesystem-search-files agent skill

Synopsis

This is an argument injection vulnerability in AnythingLLM that leads to remote code execution. An attacker who can send chat messages to an agent instance reaches the flaw over the network using any low-privilege account; no special privileges are required beyond basic chat access. By crafting a malicious ripgrep pattern, the attacker causes the server to execute arbitrary shell commands inside the AnythingLLM container. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the AnythingLLM chat endpoint over the network; the service must be accessible from the attacker's location.

• AuthenticationRequired

  A low-privilege account with chat access is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  No victim action is needed; the attacker drives the exploit entirely through their own chat input.

• Attack complexityDetail

  Exploitation involves chaining two agent skills (filesystem-write-text-file and filesystem-search-files) and depends on the filesystem plugin being enabled, which is the default in the official Docker image but introduces environmental preconditions.

Blast Radius

• The attacker executes arbitrary shell commands inside the AnythingLLM server container, giving full control over running processes.
• All data readable by the container process, including LLM context, stored documents, API keys, and environment variables, is exposed to the attacker.
• The attacker can write, overwrite, or delete any files accessible to the container, corrupting stored knowledge bases and configuration.
• The container runtime itself can be crashed or used as a pivot point for further movement within the host network.