Librechat CVE-2026-34371

This vulnerability carries moderate real-world risk despite a medium CVSS score of 6.3. The attack vector is network-based and requires low privileges (authenticated user, PR:L) with high complexity (AC:H), limiting the attack surface to authenticated sessions. The CVSS impact shows integrity compromise only (I:H, no confidentiality or availability impact), suggesting file overwrite rather than system compromise. However, the lack of complexity for exploitation (once authenticated) and the potential to inject malicious files into the client distribution directory (dist/poc.txt suggests client-side payload injection) elevates practical risk. The confirmed patch in version 0.8.4 and the specific mention of this being fixed indicate vendor responsiveness. Organizations running LibreChat versions below 0.8.4 with execute_code enabled and default file storage should prioritize patching. The vulnerability is not confirmed actively exploited (no CISA KEV status provided), and no public proof-of-concept code is referenced, reducing immediate threat likelihood but not eliminating the need for prompt remediation.

An authenticated LibreChat user with access to the code execution feature crafts a prompt that triggers the execute_code sandbox, but includes a malicious artifact name such as '../../../../../app/client/dist/malicious.js' in the response. The application concatenates this unsanitized filename into the file write path without validation, allowing the attacker to write a JavaScript payload into the client distribution directory. When other users or administrators load the LibreChat frontend, the injected script executes in their browser context, potentially stealing session tokens, credentials, or performing actions on behalf of legitimate users. No public exploit code or active exploitation in the wild has been documented at the time of this analysis.