Summary

AnythingLLM Desktop (v1.11.1) contains a Streaming Phase XSS vulnerability in the chat rendering pipeline that escalates to Remote Code Execution on the host OS due to insecure Electron configuration. This works with default settings and requires no user interaction beyond normal chat usage.

Details

Root Cause

The custom markdown-it image renderer in frontend/src/utils/chat/markdown.js (lines 70-77) interpolates token.content directly into the alt attribute without HTML entity escaping. The PromptReply component (line 99) renders this output via dangerouslySetInnerHTML without DOMPurify sanitization — unlike HistoricalMessage (line 280) which correctly applies DOMPurify.sanitize().

Attack Vector

An attacker can trigger this vulnerability by embedding a prompt injection payload in a RAG document, controlling a malicious LLM endpoint, or compromising any upstream source that influences the model's response:
![" onerror="require('child_process').exec('open -a calculator')](x)
When a victim asks any question in that workspace, the LLM includes the payload in its streaming response. The custom image renderer produces:
<img src="x" alt="" onerror="require('child_process').exec('open -a calculator')" />
Because the Electron app is configured with nodeIntegration: true and contextIsolation: false, the onerror handler has direct access to Node.js APIs, resulting in arbitrary code execution.

PoC

Impact

Successful exploitation grants the attacker arbitrary code execution on the victim's operating system with the full privileges of the AnythingLLM Desktop process. This allows an attacker to:

• Read and exfiltrate sensitive files (SSH keys, credentials, personal documents)
• Install persistent backdoors or malware
• Pivot to other systems on the local network
• Fully compromise the confidentiality, integrity, and availability of the host

Credit

Jingcheng Yang, Zhengyu Liu, Jianjun Chen