Anil-matcha vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Anil-matcha products: 2 record(s), with severity, exploitation and fixes.

Open-Generative-AI 2

Exploited only (KEV) →

CVE-2026-90603 High · 7.3 CWE-284 Sep 13, 2026

Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be launched remotely. The name of the patch is f013270957f75e439eaf97eb2a93decb32a4543e. Applying a patch is advised to resolve this issue.

CVE-2026-90602 Low · 3.5 CWE-79 Sep 13, 2026

Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this vulnerability is the function renderHistory of the file ImageStudio.js of the component Studio Components. This manipulation causes cross site scripting. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.