What happened
AnythingLLM's admin system-preferences API allows a manager-role account to set page-metadata fields that are later injected unsanitized into generated HTML by MetaGenerator, producing a stored XSS vulnerability.
Why it matters
AnythingLLM is a popular self-hosted RAG/chat platform; while this requires manager-level privilege to exploit, it allows a malicious or compromised manager account to run arbitrary script in the browser context of any other user who loads the affected page, potentially leading to session/credential theft.
Attack vector
A manager-role user stores attacker-controlled meta_page_title or meta_page_favicon values via /api/admin/system-preferences; MetaGenerator inserts those values into produced pages without sufficient sanitization, resulting in stored XSS against any user who views the affected page.
Affected systems
AnythingLLM, versions ≤ 1.16.1
Mitigation
Upgrade to the patched AnythingLLM release addressing CVE-2026-88055 per the vendor commit.