AnythingLLM's in-chat markdown renderer prior to version 1.12.1 uses a custom rule for images that inserts the markdown image's alt text directly into an HTML alt attribute without HTML encoding. While most renderMarkdown calls are sanitized with DOMPurify, the Chartable component renders chart captions without sanitization. Since chart captions are generated from natural language output by the LLM, an attacker who can influence the LLM output (via indirect prompt injection or by creating chart records in multi-user workspaces) can inject stored DOM-level XSS payloads. These payloads execute in other users' browsers when they open the conversation. The vulnerability is fixed in version 1.12.1.

Successful exploitation allows an attacker to execute stored cross-site scripting attacks in the browsers of other users viewing the affected chat conversations. This can lead to theft of sensitive information or session tokens (confidentiality impact is high), limited integrity impact, and no impact on availability. The vulnerability requires network access and user interaction, with a high attack complexity and low privileges required.

A patch is available in AnythingLLM version 1.12.1 that fixes this vulnerability by properly sanitizing the chart captions. Users should upgrade to version 1.12.1 or later to remediate this issue. No other mitigation is specified or required by the vendor advisory.