CVE-2024-3104

CVE-2024-3104 is a critical remote code execution vulnerability affecting mintplex-labs/anything-llm, specifically versions prior to 1.0.0. Attackers can exploit this by injecting arbitrary environment variables through the POST /api/system/update-env endpoint, leading to arbitrary code execution on the host. With a CVSS score of 9.8 (Critical), this vulnerability allows for complete compromise of confidentiality, integrity, and availability without user interaction or authentication. While there is no evidence of active exploitation, public exploit code, or significant community discussion, the high FAUCET Risk Score of 86/100 indicates a severe threat.