Mintplex-Labs/anything-llm
1
0
Fork 0
mirror of https://github.com/Mintplex-Labs/anything-llm.git synced 2026-07-19 22:23:50 -04:00
Code Issues 328 Packages Projects Releases 10 Wiki Activity

[GH-ISSUE #4961] [FEAT]: Security: Verify integrity and licenses of auto-downloaded embedding models #3109

New Issue
Closed
opened 2026-02-22 18:32:39 -05:00 by yindo · 0 comments
yindo commented 2026-02-22 18:32:39 -05:00
Owner
Copy Link
Copy Source

Originally created by @arsbr on GitHub (Feb 3, 2026).
Original GitHub issue: https://github.com/Mintplex-Labs/anything-llm/issues/4961

What would you like to see?

AnythingLLM automatically downloads embedding models (via @xenova/transformers) without verifying their integrity or license.

In server/utils/EmbeddingEngines/native/index.js, the code pulls models based on EMBEDDING_MODEL_PREF. If a user (or an attacker with config access) points this to a compromised repo, the system will download and load it.

There is no check for:

  1. Integrity: Does the file hash match the official Hugging Face record? (Protection against MITM/Corruption).
  2. License: Is the model CC-BY-NC (Non-Commercial)? This is critical for enterprise users of AnythingLLM.

I suggest adding a pre-flight check before initializing the embedding pipeline.
I maintain an open-source tool called Veritensor (Apache 2.0) that handles this logic (Hash verification against HF API + License detection in Safetensors/GGUF headers).

You could integrate a similar check in embedderClient:

  1. Download the model file to a temp location.
  2. Verify its SHA256 against the HF API.
  3. Check metadata for restrictive licenses.
  4. Only then load it into the pipeline.

This would prevent scenarios where a typo in the model name leads to downloading a malicious or broken file, crashing the application or exposing it to supply chain attacks.

In the attachments you can find an example of the full code for integration.

AnythingLLM_scan.py

Originally created by @arsbr on GitHub (Feb 3, 2026). Original GitHub issue: https://github.com/Mintplex-Labs/anything-llm/issues/4961 ### What would you like to see? AnythingLLM automatically downloads embedding models (via `@xenova/transformers`) without verifying their integrity or license. In `server/utils/EmbeddingEngines/native/index.js`, the code pulls models based on `EMBEDDING_MODEL_PREF`. If a user (or an attacker with config access) points this to a compromised repo, the system will download and load it. There is no check for: 1. Integrity: Does the file hash match the official Hugging Face record? (Protection against MITM/Corruption). 2. License: Is the model `CC-BY-NC` (Non-Commercial)? This is critical for enterprise users of AnythingLLM. I suggest adding a pre-flight check before initializing the embedding pipeline. I maintain an open-source tool called [Veritensor](https:/github.com/ArseniiBrazhnyk/Veritensor) (Apache 2.0) that handles this logic (Hash verification against HF API + License detection in Safetensors/GGUF headers). You could integrate a similar check in `embedderClient`: 1. Download the model file to a temp location. 2. Verify its SHA256 against the HF API. 3. Check metadata for restrictive licenses. 4. Only then load it into the pipeline. This would prevent scenarios where a typo in the model name leads to downloading a malicious or broken file, crashing the application or exposing it to supply chain attacks. In the attachments you can find an example of the full code for integration. [AnythingLLM_scan.py](https://github.com/user-attachments/files/25047783/AnythingLLM_scan.py)
yindo added the enhancementfeature request labels 2026-02-22 18:32:39 -05:00
yindo closed this issue 2026-02-22 18:32:39 -05:00
yindo changed title from [FEAT]: Security: Verify integrity and licenses of auto-downloaded embedding models to [GH-ISSUE #4961] [FEAT]: Security: Verify integrity and licenses of auto-downloaded embedding models 2026-06-05 14:50:21 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Desktop
Docker
Integration Request
Integration Request
OS: Linux
OS: Mobile
OS: Windows
UI/UX
blocked
bug
bug
core-team-only
documentation
duplicate
embed-widget
enhancement
feature request
github_actions
good first issue
investigating
needs info / can't replicate
possible bug
pull-request
Mirrored from GitHub Pull Request
 question
stage: specifications
wontfix
No Label enhancement feature request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Mintplex-Labs/anything-llm#3109
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?