Librechat CVE-2026-33265

The CVSS 3.1 score of 6.3 reflects a medium-severity vulnerability with low attack complexity (AC:L) and low privilege requirements (PR:L), but the impact is constrained to local attack vector (AV:L) and partial confidentiality/integrity/availability loss (C:L/I:L/A:L). However, real-world risk is elevated by several factors: (1) the PoC is publicly available via SBA Research, reducing exploitation friction; (2) the vulnerability affects authenticated users only, limiting the attack surface compared to unauthenticated RCE; (3) EUVD classification and OSS-Security mailing list disclosure indicate coordinated vulnerability disclosure was followed. The CVSS vector suggests this is not a critical system compromise, but in environments where RAG APIs handle sensitive data (medical records, proprietary documents), the confidentiality breach becomes more severe. SSVC analysis would classify this as low technical impact with moderate exploitability, warranting urgent patching for organizations handling sensitive data through LibreChat's RAG integration.

An authenticated LibreChat user with local system access obtains their JWT token from the browser's local storage or application cache. The attacker submits this token to the RAG API endpoints (e.g., document upload, context retrieval) without modification. Because the RAG API does not validate the token's intended scope or audience, the request succeeds, allowing the attacker to read or inject documents into the RAG context that they should not have access to. A proof-of-concept demonstrating this token reuse is available in the SBA Research advisory, enabling rapid exploitation by security researchers or malicious actors with access to a LibreChat deployment.