CVE-2026-32626: 
Homebrew vulnerability analysis and mitigation

CVE-2026-32626 is a Streaming Phase XSS-to-RCE vulnerability in AnythingLLM Desktop that allows an attacker to achieve arbitrary code execution on the host operating system via a malicious LLM response. It affects AnythingLLM Desktop versions 1.11.1 and earlier, and was disclosed on March 13, 2026 by researchers Jingcheng Yang, Zhengyu Liu, and Jianjun Chen. The vulnerability carries a CVSS v3.1 base score of 9.6 (Critical) (GitHub Advisory).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation / Cross-Site Scripting). The custom markdown-it image renderer in frontend/src/utils/chat/markdown.js (lines 70–77) interpolates token.content directly into the HTML alt attribute without HTML entity escaping. The PromptReply component then renders this output via React's dangerouslySetInnerHTML without applying DOMPurify sanitization — a protection that is correctly implemented in the HistoricalMessage component. Because the Electron application is configured with nodeIntegration: true and contextIsolation: false, any injected onerror handler in the rendered HTML gains direct access to Node.js APIs, enabling full RCE. The attack requires only that the victim interacts normally with a chat workspace where a malicious payload has been introduced (GitHub Advisory, Patch Commit).

Successful exploitation grants the attacker arbitrary code execution on the victim's host OS with the full privileges of the AnythingLLM Desktop process. This enables exfiltration of sensitive files (SSH keys, credentials, personal documents), installation of persistent backdoors or malware, and lateral movement to other systems on the local network. The vulnerability fully compromises the confidentiality, integrity, and availability of the host system (GitHub Advisory).

A proof-of-concept exploit with detailed reproduction steps is publicly available in the official GitHub Security Advisory, including a concrete malicious payload and a recorded demonstration (poc.mov). The attack requires no special privileges and only minimal user interaction (asking any question in the affected workspace). The EPSS score is 0.00157, and there is no current evidence of active in-the-wild exploitation or CISA KEV catalog listing. No specific threat actor attribution has been reported (GitHub Advisory).

1. Establish an injection point: Gain the ability to influence the LLM's response — either by embedding a prompt injection payload in a RAG document ingested into a workspace, controlling a malicious LLM endpoint, or compromising any upstream source that shapes the model's output.
2. Craft the XSS payload: Prepare a malicious markdown image tag that injects an onerror event handler into the alt attribute, e.g.:

   ![" onerror="require('child_process').exec('open -a calculator')](x)

3. Trigger the streaming response: Wait for or prompt a victim user to ask any question in the affected workspace. The LLM includes the payload in its streaming response, which is processed by the vulnerable PromptReply component.
4. XSS executes in Electron context: The custom markdown-it renderer produces unsanitized HTML with the injected onerror attribute. Because dangerouslySetInnerHTML is used without DOMPurify, the browser engine renders the tag and triggers the onerror handler.
5. Achieve RCE via Node.js APIs: Due to nodeIntegration: true and contextIsolation: false in the Electron configuration, the onerror handler has direct access to Node.js APIs (e.g., child_process), resulting in arbitrary OS command execution with the privileges of the AnythingLLM Desktop process (GitHub Advisory).

• Network: Unexpected outbound connections from the AnythingLLM Desktop process to unknown external hosts (potential C2 or data exfiltration); unusual DNS queries originating from the application.
• Process: Unexpected child processes spawned by the AnythingLLM Electron process (e.g., open, calc.exe, bash, cmd.exe, curl, wget, python); new processes with the AnythingLLM process as parent that are unrelated to normal LLM operations.
• File System: New or modified files in user home directories (e.g., ~/.ssh/, credential stores, startup/persistence locations); unexpected scripts or executables dropped in temp directories or application data folders.
• Logs: Electron/Chromium renderer logs showing onerror handler execution or Node.js child_process calls; application logs reflecting unusual LLM responses containing markdown image syntax with event handler attributes.

Mintplex Labs has released a patch in commit 9e2d144dc8be6fab29f560f5bcdaa9ef7dbb4214, available in AnythingLLM Desktop version 1.11.2 and later. The fix adds DOMPurify sanitization to the PromptReply component, consistent with the existing sanitization in HistoricalMessage. Users should update to version 1.11.2+ immediately. As additional hardening, administrators should review Electron security configuration to enforce Content Security Policies and disable nodeIntegration / enable contextIsolation where possible, and ensure all RAG document sources are trusted (GitHub Advisory, Patch Commit).

The vulnerability received notable attention across security communities shortly after disclosure. Posts appeared on Mastodon, Bluesky, and Reddit (r/cybersecurity) discussing the XSS-to-RCE chain and its implications for AI desktop applications. The OWASP AISVS project also referenced the issue in a GitHub discussion, highlighting it as a relevant case study for AI application security standards. Security blogs including Yazoul and Raxe AI published advisories covering the vulnerability (Yazoul Advisory, Raxe Advisory).