Is CVE-2024-3166 actively exploited?

CVE-2024-3166 has no public evidence of in-the-wild exploitation as of 2024-11-21.

What is the CVSS score for CVE-2024-3166?

CVE-2024-3166 has a CVSS score of 9.6 (CRITICAL severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

How do I patch CVE-2024-3166?

Patch guidance is available from mintplexlabs security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2024-3166.

Fix CVE-2024-3166 - CRITICAL

Q: Which products are affected by CVE-2024-3166?

2 products: mintplexlabs anythingllm desktop, mintplexlabs anythingllm webapp.

Description

A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. The vulnerability arises from the application's feature to fetch and embed content from websites into workspaces, which can be exploited to execute arbitrary JavaScript code. In the desktop application, this flaw can be escalated to Remote Code Execution (RCE) due to insecure application settings, specifically the enabling of 'nodeIntegration' and the disabling of 'contextIsolation' in Electron's webPreferences. The issue has been addressed in version 1.4.2 of the desktop application.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack Vector: network
Complexity: low
Privileges: none
User Action: required
Scope: changed
Confidentiality: high
Integrity: high
Availability: high
Weaknesses: CWE-79 · Cross-site Scripting (XSS)

Metadata

Primary Vendor: MINTPLEXLABS
Published: 6/6/2024
Last Modified: 11/21/2024
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

mintplexlabs : anythingllm_desktopmintplexlabs : anythingllm_webapp

Remediation Guidance

Executive Summary

Cite this page

CVE-2024-3166. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2024-3166

View on NIST NVD

CVE-2024-3166 vulnerability