AnythingLLM contains a stored DOM‑level cross‑site scripting flaw in its chart caption renderer. The application renders LLM‑generated captions via an unsafe custom markdown rule that inserts the image alt text directly into an HTML attribute without encoding. Although most rendering paths are protected by DOMPurify, the Chartable component bypasses this safeguard, allowing attacker‑controlled content to be stored and later executed in any user’s browser. The flaw can lead to arbitrary JavaScript execution, enabling attackers to steal session data, deface the interface, or perform further malicious actions within the victim’s environment.

The issue affects all Mintplex‑Labs AnythingLLM installations running any version prior to 1.12.1. The vulnerability resides in the Chartable component responsible for displaying chart captions that are generated by the LLM during chat sessions.

The CMS approach yields a CVSS score of 5.4, classifying the vulnerability as moderate severity. The EPSS score of less than 1% indicates a low but non‑zero likelihood that this flaw will be actively exploited in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires an attacker to influence the LLM’s output—most cheaply via prompt injection in a shared document or by creating a chart record in a multi‑user workspace—so while the attack vector is relatively low effort, it also requires some level of collaboration or co‑editorship access to the workspace. Overall, the risk is moderate but defensible, especially for environments with shared workspaces or permissive LLM prompts.