Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-8251Prisma Injection in mintplex-labs/anything-llm

Medium 5.3

In plain English

A medium-severity SQL injection in mintplex-labs/anything-llm from mintplex-labs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.0)5.3Medium

Exploit odds (30 days)0.5%top 57.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability in mintplex-labs/anything-llm prior to version 1.2.2 allows for Prisma injection. The issue exists in the API endpoint "/embed/:embedId/stream-chat" where user-provided JSON is directly taken to the Prisma library's where clause. An attacker can exploit this by providing a specially crafted JSON object, such as {"sessionId":{"not":"a"}}, causing Prisma to return all data from the table. This can lead to unauthorized access to all user queries in embedded chat mode.

Affected products (as reported)

Vendor	Product	Versions
mintplex-labs	mintplex-labs/anything-llm	unspecified – before 1.2.2

Weakness: CWE-89 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

In plain English

Official description

Affected products (as reported)

References