CVE-2026-88055: AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and earlier, the manager role can store metapagetitle or metapagefavicon through /api/admin/system-preferences, and MetaGenerator inserts those values into production homepage HTML without escaping attribute values or text content. The values pass unchanged through server/models/systemSettings.js and reach MetaGenerator.generate() in server/index.js. #assembleMeta() in server/utils/boot/MetaGenerator.js concatenates the stored values into HTML. When an administrator visits the homepage /, injected JavaScript can read the administrator JWT and use it to create API keys, access or modify workspace and chat data, delete users, and perform other administrator actions. server/endpoints/admin.js accepts the manager-controlled settings before server/models/systemSettings.js returns them unchanged. No fixed version is available as of this review.
Affected Software
Event History
Frequently Asked Questions
Who can introduce the malicious content, and who must trigger it?
A user with the manager role can store malicious values through /api/admin/system-preferences. The payload executes when an administrator visits the homepage (/).
Are default deployments affected?
The issue is reachable through the administrative system-preferences API and affects versions 1.16.1 and earlier. The provided data does not identify any additional configuration prerequisite.
What could an attacker do after the payload executes?
Injected JavaScript can read the administrator JWT. It can then be used to create API keys, access or modify workspace and chat data, delete users, and perform other administrator actions.
What mitigation is available if patching cannot be completed immediately?
No fixed version is available as of the review. Limit manager-role access and prevent untrusted users from setting meta_page_title or meta_page_favicon through /api/admin/system-preferences.