AnythingLLM versions before 1.13.0 contain a command injection vulnerability (CWE-77) in the filesystem-search-files agent skill. The skill passes a pattern parameter controlled by the language model directly to ripgrep as a positional argument without a '--' end-of-options separator. Since ripgrep treats arguments starting with '-' as options, an attacker can supply a pattern like '--pre=/bin/sh' to cause ripgrep to execute '/bin/sh <file>' on each file it processes. Combined with the filesystem-write-text-file skill, this allows arbitrary command execution within the AnythingLLM server container. The vulnerability is resolved in version 1.13.0.

Successful exploitation allows an attacker with access to chat with the agent on a deployment that has the filesystem plugin enabled (default in the official Docker image) to execute arbitrary commands inside the server container. This can lead to full compromise of the container environment, including confidentiality, integrity, and availability impacts as indicated by the CVSS score of 7.5 (high severity). There are no known exploits in the wild at this time.

This vulnerability is fixed in AnythingLLM version 1.13.0. Users should upgrade to version 1.13.0 or later to remediate this issue. Since the vendor advisory does not provide an official patch link or temporary workaround, upgrading is the recommended action. Deployments without the filesystem plugin enabled are not vulnerable. Patch status is not explicitly confirmed beyond the stated fix in 1.13.0; users should verify with the vendor for the latest remediation guidance.