The flaw arises when an AnythingLLM agent skill passes a pattern provided by the LLM to the ripgrep tool without an end‑of‑options separator. Ripgrep interprets any argument starting with a dash as an option, so a user‑controlled pattern such as --pre=/bin/sh causes ripgrep to execute /bin/sh with the matched file name as an argument. This allows an attacker who can interact with the agent to run arbitrary commands inside the AnythingLLM server container. The vulnerability is therefore a high‑severity remote code execution flaw linked to unsafe command line construction (CWE‑77) and command injection via a pre‑command option (CWE‑88).

The vulnerability affects all releases of Mintplex‑Labs AnythingLLM before version 1.13.0, including the default Docker image in which the filesystem plugin is enabled by default. Any deployment that has the filesystem‑search‑files agent skill active and accepts LLM‑controlled patterns is impacted.

With a CVSS score of 7.5, the risk is considered high. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack path requires an attacker who can submit chat inputs to the agent; by providing a malicious pattern such as --pre=/bin/sh and using the sibling filesystem‑write‑text‑file skill, the attacker can gain command execution capability within the container, compromising confidentiality, integrity, and availability of the host system.