CVE-2024-8251

🗓️ 20 Mar 2025 10:08:48Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 94 Views🌐 WEB

Vulnerability in mintplex-labs/anything-llm allows Prisma injection before version 1.2.2.

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2024-8251	20 Mar 202519:18	–	circl
CNNVD	anything-llm 输入验证错误漏洞	20 Mar 202500:00	–	cnnvd
Cvelist	CVE-2024-8251 Prisma Injection in mintplex-labs/anything-llm	20 Mar 202510:08	–	cvelist
EUVD	EUVD-2025-6903	3 Oct 202520:07	–	euvd
NVD	CVE-2024-8251	20 Mar 202510:15	–	nvd
Positive Technologies	PT-2025-12227 · Prisma +1 · Prismax +1	20 Mar 202500:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2024-8251: Improper Neutralization of Special Elements used in an SQL Command	20 Mar 202500:00	–	rapid7
RedhatCVE	CVE-2024-8251	22 Mar 202512:44	–	redhatcve
Vulnrichment	CVE-2024-8251 Prisma Injection in mintplex-labs/anything-llm	20 Mar 202510:08	–	vulnrichment

NVD

Vulners

Node

mintplexlabs anythingllmRange<1.2.2

[
  {
    "vendor": "mintplex-labs",
    "product": "mintplex-labs/anything-llm",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "1.2.2",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/7c263ef1-7d50-475a-9425-b15df4e0403c
github	www.github.com/mintplex-labs/anything-llm/commit/334fd9cdd02ad4aa6a3c9bdfc95e7764651c13f4

Parameter	Position	Path	Description	CWE
body	request body	/embed/:embedId/stream-chat	Prisma injection via unvalidated JSON in request body to Prisma 'where' clause, enabling access to all user queries in embedded chat mode.	CWE-89, CWE-20

17 Jun 2026 08:22Current

6Medium risk

Vulners AI Score6

CVSS 35.3

EPSS0.00481

SSVC