CVE-2024-10109: A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint…

PriorityP348high8.3CVSS 3.0

AVNACLPRLUINSUCHILAH

EPSS

0.49%

38.3th percentile

A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access enables them to modify the model's API key and base path, leading to potential API key leakage and denial of service on chats.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
mintplex-labs	mintplex-labs_anything-llm	>= unspecified < 1.3.1	1.3.1
mintplexlabs	anythingllm	< 1.3.1	1.3.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.