EUVD-2026-39463Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network delivery, low complexity; PR:L because submission requires authentication; UI:R because victim must render the preview; S:C for iframe context crossing; C:L/I:L for session theft and DOM manipulation with no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, there is a vulnerability in LibreChat's markdown artifact preview pipeline. The marked library v15.0.12 does not HTML-escape double-quote characters in image alt text when a custom renderer falls through to the default renderer. LibreChat's generateMarkdownHtml function (in client/src/utils/markdown.ts) installs a custom image renderer that returns false for URLs passing the isSafeUrl allowlist check, which causes marked to fall back to its built-in renderer. That built-in renderer inserts the raw alt text into the alt="..." attribute without escaping double-quote characters. An attacker can craft an alt text such as " onload="payload to break out of the attribute and inject an arbitrary event handler. The resulting HTML is then assigned to document.getElementById('content').innerHTML inside the Sandpack preview iframe, causing the payload to execute in the victim's browser. This vulnerability is fixed in 0.8.4-rc1.
AnalysisAI
Cross-site scripting in LibreChat's markdown artifact preview pipeline allows an authenticated attacker to inject arbitrary JavaScript into a victim's browser session via crafted image alt text. The marked library v15.0.12 fails to HTML-escape double-quote characters in image alt text when LibreChat's custom image renderer falls through to the built-in renderer, enabling attribute breakout via payloads like " onload="payload. The resulting unsanitized HTML is written directly to innerHTML inside the Sandpack preview iframe, executing attacker-controlled code in the victim's browser. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; fixed in version 0.8.4-rc1.
Technical ContextAI
LibreChat (CPE: cpe:2.3:a:danny-avila:librechat:*:*:*:*:*:*:*:*) is a self-hosted, multi-provider AI chat frontend that renders user-controlled markdown through the marked library (v15.0.12). The root cause (CWE-79: Improper Neutralization of Input During Web Page Generation) originates in the interaction between LibreChat's custom image renderer in client/src/utils/markdown.ts and the marked fallback mechanism. When the custom renderer returns false for an image URL that passes the isSafeUrl allowlist, marked silently falls back to its built-in renderer, which writes the raw alt attribute value without escaping double-quote characters. The final HTML string is then assigned via document.getElementById('content').innerHTML inside the Sandpack preview iframe, a client-side sink that provides no additional sanitization. The scope change (S:C in CVSS) reflects that the injected payload executes in the context of the iframe's origin rather than solely within the submitter's session.
RemediationAI
Upgrade LibreChat to version 0.8.4-rc1 or later, which resolves this vulnerability per the vendor advisory at https://github.com/danny-avila/LibreChat/security/advisories/GHSA-3phr-62qf-cxf3. If immediate upgrade is not feasible, consider restricting access to the artifact preview feature or limiting who can submit markdown content with image tags in shared instances. A compensating control would be to proxy all rendered artifact HTML through a server-side sanitizer (e.g., DOMPurify) before it reaches the Sandpack iframe's innerHTML assignment - this adds latency but eliminates the class of sink-based XSS. Disabling the Sandpack preview iframe for untrusted users is a more aggressive but effective mitigation. Note: restricting isSafeUrl allowlist entries alone does not remediate this issue, since the vulnerability is triggered specifically by URLs that pass the allowlist causing the custom renderer to return false and invoke the unsafe fallback.
A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of f
An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /ap
LibreChat 0.8.1-rc2 has SSRF in the Actions feature that allows authenticated users to make the server perform requests
LibreChat before v0.8.2-rc2 allows any authenticated user to execute shell commands as root inside the container through
LibreChat is a ChatGPT clone with additional features. Rated high severity (CVSS 8.6), this vulnerability is remotely ex
In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. Rated high severity (
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file
An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, lead
An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat
LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images. Rated critical severity (CVSS 9.8), th
LibreChat through 0.7.4-rc1 has incorrect access control for message updates. Rated critical severity (CVSS 9.8), this v
Information disclosure in LibreChat's Model Context Protocol (MCP) integration allows any authenticated user to exfiltra
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today