LibreChat CVE-2025-8848

Requires an authenticated ('logged-in') LibreChat 0.7.9 session, and the HTML payload must be delivered via the Accept-Language HTTP request header on a GET request, which is reflected unescaped into the <html lang=""> attribute. The principal limiting factor is that the request header is normally attacker-self-controlled: standard browsers do not let a third party set another user's Accept-Language value, so exploitation against a different victim depends on an additional mechanism to inject or override that header (e.g., a malicious proxy, header-smuggling, or a client that honors attacker-supplied language settings). No special non-default server configuration is indicated, but authentication and reflection of the injected header into the victim's own response are mandatory.

This is a moderate-severity (CVSS 5.4), low-priority issue in practice. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) indicates a network-reachable flaw requiring authentication (PR:L) and user interaction (UI:R), with only low confidentiality and integrity impact and a scope change reflecting the XSS crossing into the browser context. EPSS is low at 0.45% (37th percentile), and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation - only publicly available exploit code (via the huntr report). A key limiting factor stands out: per the description, the attacker is a 'logged-in user' who crafts their OWN Accept-Language header to inject HTML into their own response, which makes this effectively a self-XSS unless an attacker can force a victim's browser to send a malicious Accept-Language header (not a default browser behavior). This substantially reduces real-world risk below what the raw score suggests. The input Tags list 'RCE' and 'Code Injection', but the description and resulting impact (HTML/XSS injection) do not support remote code execution - treat the RCE label as unverified. Net: a real but low-priority finding, appropriate for routine patching rather than emergency response.

A publicly available proof-of-concept exists (huntr.com). An authenticated LibreChat user sends an HTTP GET request with a crafted Accept-Language header containing HTML markup, which is reflected unescaped into the <html lang=""> attribute of the response, allowing HTML/JavaScript injection in that user's rendered page. Because the attacker controls their own request header, meaningful cross-user impact requires an additional vector to force a victim's browser to emit the malicious header.