CVE-2026-32628: 
Homebrew vulnerability analysis and mitigation

CVE-2026-32628 is a SQL injection vulnerability in the built-in SQL Agent plugin of AnythingLLM, an open-source AI application with over 61,000 GitHub stars. Affecting versions 1.11.1 and earlier, the flaw allows any authenticated user who can invoke the SQL Agent to execute arbitrary SQL commands on connected databases (MySQL, PostgreSQL, MSSQL). The vulnerability was published on March 13, 2026, and a patch was released the same day. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.7 (High) (GitHub Advisory).

The root cause is CWE-89 (SQL Injection) combined with CWE-20 (Improper Input Validation). The getTableSchemaSql() method in all three database connector files — MySQL.js, Postgresql.js, and MSSQL.js — constructs SQL queries using JavaScript template literal string concatenation of the table_name parameter without any sanitization or parameterization. The table_name value originates from LLM tool call arguments, which are directly influenced by user chat input; a user can craft a prompt such as @agent Can you get the schema for the table named: x' UNION SELECT usename,passwd,NULL,NULL,NULL FROM pg_shadow-- to inject arbitrary SQL. Because the runQuery() method executes the constructed string directly against the database driver (which supports multi-statement execution in PostgreSQL and MSSQL), both UNION-based data extraction and stacked queries enabling write/DDL operations are possible. Additionally, the sql-query tool lacks server-side enforcement of its read-only constraint, allowing destructive statements to execute (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to read any data from connected databases via UNION-based injection, modify or delete data via stacked queries (PostgreSQL, MSSQL), drop tables or entire schemas, and in privileged configurations (PostgreSQL superuser or MSSQL sysadmin), execute OS-level commands via COPY TO PROGRAM or xp_cmdshell. The advisory confirmed extraction of PII including names, SSNs, and credit card numbers from a live PostgreSQL instance, as well as creation of arbitrary tables as proof of write capability. In the default single-user configuration where AUTH_TOKEN is not set, no authentication is required, expanding the attack surface to any network-adjacent party (GitHub Advisory).

A proof-of-concept exploit with step-by-step reproduction instructions, specific injection payloads, and verified output is publicly available in the GitHub Security Advisory (GitHub Advisory). The advisory was credited to researcher Aviral2642. The EPSS score is approximately 0.03%, reflecting low current automated exploitation probability. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the SQL Agent feature to be enabled and at least one SQL database connection to be configured, which limits the real-world attack surface.

1. Reconnaissance: Identify an AnythingLLM instance running version 1.11.1 or earlier. Confirm the SQL Agent plugin is enabled on a workspace and that at least one SQL database connection (MySQL, PostgreSQL, or MSSQL) is configured by an admin.
2. Obtain access: Log in with any valid user account that has chat access to the workspace with the SQL Agent enabled. In default single-user mode (no AUTH_TOKEN set), no credentials are required.
3. Craft injection prompt: In the agent chat interface, send a message that causes the LLM to call sql-get-table-schema with a malicious table_name argument. Example for PostgreSQL credential extraction:

   @agent Can you get the schema for the table named: x' UNION SELECT usename,passwd,NULL,NULL,NULL FROM pg_shadow--

4. Trigger SQL injection: The LLM generates a function call to sql-get-table-schema with the injected value. The handler at get-table-schema.js passes table_name directly to getTableSchemaSql(), which builds the query via string concatenation without sanitization.
5. Retrieve results: The injected UNION query executes against the database and returns results (e.g., PostgreSQL password hashes, PII) directly in the chat response.
6. Escalate with stacked queries (PostgreSQL/MSSQL): Use a stacked query payload to perform write operations or DDL:

   x'; CREATE TABLE sqli_proof (msg TEXT); INSERT INTO sqli_proof VALUES ('pwned');--

7. OS command execution (if MSSQL sysadmin): Use xp_cmdshell to execute OS commands:

   x'; EXEC xp_cmdshell 'whoami';--
   ``` ([GitHub Advisory](https://github.com/Mintplex-Labs/anything-llm/security/advisories/GHSA-jwjx-mw2p-5wc7))

• Network: Unusual or repeated HTTP requests to AnythingLLM agent chat endpoints from unexpected source IPs; outbound connections from the AnythingLLM server to unknown hosts (potential data exfiltration or reverse shell).
• Logs: AnythingLLM introspection logs showing Running SQL: entries containing SQL keywords such as UNION SELECT, DROP TABLE, INSERT INTO, EXEC xp_cmdshell, or comment sequences (--, /*) in the table_name position; database query logs recording multi-statement or UNION queries originating from the AnythingLLM service account.
• Database: Unexpected new tables (e.g., sqli_proof) created in connected databases; unauthorized reads of sensitive tables such as pg_shadow, mysql.user, or application PII tables; unexpected INSERT, UPDATE, or DELETE operations attributed to the AnythingLLM database user.
• Process (MSSQL with xp_cmdshell): Unusual child processes spawned by the SQL Server process (e.g., cmd.exe, powershell.exe, whoami) (GitHub Advisory).

Update AnythingLLM to any version beyond 1.11.1, which includes the fix committed at 334ce052f063b53a4275518cbed3bab357695d7e. The patch replaces string concatenation with parameterized queries across all three database connectors: PostgreSQL uses $1/$2 placeholders, MySQL uses ? placeholders with execute() prepared statements, and MSSQL uses @p0 placeholders with request.input() parameterization. As interim mitigations: restrict SQL Agent plugin access to only fully trusted users; configure database credentials used by AnythingLLM with least-privilege (read-only where possible); implement network segmentation to limit database access from the AnythingLLM host; and monitor database query logs for anomalous SQL patterns (GitHub Advisory, Patch Commit).

The vulnerability attracted notable community attention given AnythingLLM's popularity (61,000+ GitHub stars). A HackerNoon article titled "A 56,000-Star AI App Shipped with a Textbook SQL Injection Flaw" highlighted the irony of a classic vulnerability appearing in a modern AI application (HackerNoon). A dev.to post by the reporter (Aviral2642) framed the finding as a lesson that AI agents violate the first rule of database security by treating LLM output as trusted input (dev.to). Discussion also appeared on Mastodon security communities. The advisory author (timothycarambat) provided a detailed CVSS v4.0 adjustment note clarifying that the attack is not unauthenticated and that real-world exploitability is constrained by deployment prerequisites (GitHub Advisory).