Librechat
Monthly
Access-token theft in LibreChat before 0.8.5 lets a malicious MCP (Model Context Protocol) server hijack OAuth tokens minted for a legitimate server, because the client never checks that the RFC 9728 resource parameter matches the configured MCP server URL. Any LibreChat operator who connects their instance to an attacker-controlled MCP server can have the OAuth access tokens intended for a trusted server silently exfiltrated. SSVC rates technical impact as total and a proof-of-concept is referenced, but there is no public exploit weaponization and EPSS exploitation probability is very low (0.11%); it is fixed in 0.8.5.
Authentication-bypass weakness in LibreChat before 0.8.4-rc1 lets an attacker who already holds a valid session silently regenerate all of a victim's two-factor backup codes via POST /api/auth/2fa/backup/regenerate, which never asks for a current TOTP token or an existing backup code. With fresh codes in hand, the attacker can bypass 2FA at login or turn 2FA off entirely, neutralizing the account's second factor. EPSS is low (0.15%, 5th percentile) and no active exploitation is recorded, but proof-of-concept exploitation is acknowledged in the SSVC framework.
Two-factor authentication takeover in LibreChat before 0.8.4-rc1 lets any authenticated user — or an attacker wielding a stolen session token — call the GET /api/auth/2fa/enable endpoint to silently overwrite an account's existing TOTP secret, regenerate backup codes, and flip twoFactorEnabled to false, all without TOTP or backup-code verification. The flaw destroys the victim's working second factor and can lock the legitimate owner out of their own 2FA. Publicly available exploit code exists (SSVC: PoC), but EPSS is low (0.18%, 8th percentile) and it is not listed in CISA KEV.
Information disclosure in LibreChat's Model Context Protocol (MCP) integration allows any authenticated user to exfiltrate critical secrets such as JWT_SECRET and MongoDB credentials by configuring a malicious MCP server URL with environment variable placeholders. The vulnerability affects LibreChat versions up to 0.8.3, and publicly available exploit code exists. While EPSS indicates low exploitation probability (0.03%), the ease of exploitation and high impact make immediate patching critical for deployments with the MCP feature enabled.
Cross-user API key overwrite in LibreChat versions up to and including 0.7.6 allows any authenticated user to replace another user's stored provider API keys (OpenAI, Anthropic, Azure) by injecting a userId parameter into PUT /api/keys requests. The flaw stems from an Insecure Direct Object Reference where the JavaScript spread operator overrides the server-set authenticated user ID, enabling conversation hijacking or denial of service. No public exploit identified at time of analysis, and the issue is fixed in 0.8.3-rc1.
Server-side request forgery in LibreChat 0.8.2-rc2 through 0.8.2 allows authenticated users to access internal network resources via incomplete DNS validation bypass. Despite a prior SSRF patch, the current hostname validation fails to check if DNS resolution points to private IP addresses, enabling attackers to reach internal RAG APIs and cloud metadata endpoints. CVSS 7.7 with network-based attack vector and low complexity. EPSS data not available; no confirmed active exploitation (not listed in CISA KEV). Patch released in version 0.8.3-rc1.
Server-Side Request Forgery (SSRF) in LibreChat versions prior to 0.8.3 allows authenticated users to bypass IP validation and force the application server to make HTTP requests to internal network resources. The vulnerability stems from improper validation of IPv4-mapped IPv6 addresses in hex-normalized form, enabling access to cloud metadata services (AWS 169.254.169.254), loopback addresses, and RFC1918 private networks. With EPSS data unavailable and no CISA KEV listing, no public exploit identified at time of analysis, though the specific bypass technique (hex-normalized IPv4-mapped IPv6) is well-documented in SSRF research.
CVE-2026-4276 is a security vulnerability (CVSS 7.5) that allows attackers. High severity vulnerability requiring prompt remediation.
LibreChat versions 0.8.2 through 0.8.2-rc3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) OAuth callback endpoint that allows attackers to steal OAuth tokens by tricking victims into completing an OAuth flow, resulting in account takeover of the victim's MCP-linked services like Atlassian and Outlook. No active exploitation is known (not in KEV), no POC is publicly available, and EPSS data is not yet available for this newly disclosed vulnerability.
LibreChat before v0.8.2-rc2 allows any authenticated user to execute shell commands as root inside the container through the MCP stdio transport. A single API request is sufficient for root code execution. PoC available, patch available.
Unrestricted file upload to the POST /api/convos/import endpoint in LibreChat prior to 0.8.4-rc1 allows any authenticated user to exhaust server disk space and memory, causing a denial of service. The root cause is an incomplete remediation of CVE-2024-11171: while file size limits were added to the shared multer factory, the import endpoint's independent multer instance was never updated, and the application-level fallback guard (CONVERSATION_IMPORT_MAX_FILE_SIZE_BYTES) is commented out in .env.example by default. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity for any authenticated user makes this a meaningful operational risk for public-facing or open-registration deployments.
Cross-site scripting in LibreChat's markdown artifact preview pipeline allows an authenticated attacker to inject arbitrary JavaScript into a victim's browser session via crafted image alt text. The marked library v15.0.12 fails to HTML-escape double-quote characters in image alt text when LibreChat's custom image renderer falls through to the built-in renderer, enabling attribute breakout via payloads like `" onload="payload`. The resulting unsanitized HTML is written directly to `innerHTML` inside the Sandpack preview iframe, executing attacker-controlled code in the victim's browser. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; fixed in version 0.8.4-rc1.
LibreChat's POST /api/files/images endpoint lacks the authorization check that was correctly applied to the POST /api/files route in a prior patch, allowing any authenticated user to upload files into arbitrary agents' tool_resources (including context and execute_code environments) without ownership or EDIT permission verification. All LibreChat deployments prior to 0.8.4-rc1 are affected across any multi-user configuration. No active exploitation has been confirmed (not in CISA KEV), but the bypass is trivially exercisable by any valid session holder who knows a target agent ID.
Broken object-level authorization in LibreChat's message deletion endpoint allows any authenticated user to permanently delete messages belonging to other users. Affected are all LibreChat deployments prior to 0.8.4-rc1. By supplying their own valid conversationId for middleware validation while targeting a victim's messageId in the underlying MongoDB query, an attacker bypasses the per-user authorization check and irreversibly removes arbitrary messages. No public exploit or CISA KEV listing exists at time of analysis, but the flaw is straightforward to exploit once a valid messageId is obtained.
Server-side request forgery in LibreChat before 0.8.4-rc1 lets any authenticated user point a custom OpenAI-compatible endpoint baseURL at internal network addresses, because the URL is used to build HTTP requests with no SSRF validation whatsoever - no private-IP blocking, no scheme restriction, and no DNS pinning. By abusing the legitimate custom-endpoint feature, a logged-in user can coerce the server into reaching internal-only services and returning their responses, with a CVSS 3.1 score of 7.7 driven by a changed scope and high confidentiality impact. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the trivial low-complexity nature makes it readily exploitable once an account exists.
Rate limiter bypass in LibreChat prior to 0.8.4-rc1 allows any authenticated user to exhaust server resources via the POST /api/convos/duplicate endpoint, which performs identical expensive database operations as /api/convos/fork but was inadvertently omitted from the CVE-2025-7105 remediation scope. Operators who applied the prior fix may believe resource exhaustion was fully mitigated - they remain exposed through this overlooked parallel endpoint. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low exploitation complexity and bypass nature make this operationally significant for multi-tenant or publicly accessible LibreChat deployments.
Cross-agent file deletion in LibreChat 0.8.3 and earlier allows an authenticated shared-agent editor to permanently destroy files that the owner reuses across multiple agents by calling DELETE /api/files - removing the file globally rather than just from the shared agent context. The owner's private agents, which the editor has no access to, silently retain stale file_id references that no longer resolve, causing integrity and availability degradation across unrelated agents. Exploit proof-of-concept code exists (CVSS E:P); this is not confirmed as actively exploited in CISA KEV, but the low-privilege network-accessible attack path warrants prompt patching to 0.8.4.
LibreChat's MCP server configuration API leaks decrypted admin-managed credentials - including plaintext API keys and OAuth client secrets - to any authenticated user holding only VIEW-level access to a shared MCP server. All deployments running versions up to and including 0.8.3 are affected, with the flaw accessible via standard GET requests to `/api/mcp/servers` and `/api/mcp/servers/:serverName`. No public exploit or active exploitation has been identified at time of analysis, but the low-complexity, low-privilege network vector makes credential exfiltration straightforward in any multi-user LibreChat environment.
Arbitrary file write in LibreChat prior to 0.8.4 allows authenticated users to overwrite arbitrary server files via path traversal in code artifact filenames. The vulnerability affects LibreChat deployments using the default local file storage strategy, where the execute_code sandbox returns a user-controllable filename that is concatenated directly into the file write path without sanitization. An authenticated attacker can craft malicious artifact names containing traversal sequences (e.g., ../../../../../app/client/dist/poc.txt) to write files outside the intended directory, potentially compromising application integrity or enabling remote code execution through client-side file injection.
LibreChat versions 0.8.2-rc1 through 0.8.3-rc1 leak OAuth access tokens when authenticated users interact with malicious MCP servers, which can inject credential placeholders into HTTP headers that are automatically substituted with sensitive tokens. An attacker can create a rogue MCP server containing headers like {{LIBRECHAT_OPENID_ACCESS_TOKEN}} to harvest victim credentials during tool execution; the vulnerability is fixed in version 0.8.3-rc2. No public exploit code or CISA KEV listing is documented, but the attack requires user interaction (UI:R) and authenticated access (PR:L), limiting real-world impact.
Unauthenticated stream hijacking in LibreChat versions 0.8.2-rc2 through 0.8.2-rc3 allows authenticated users to read other users' real-time chat conversations via the SSE streaming endpoint `/api/agents/chat/stream/:streamId` without ownership verification. An attacker with valid credentials can enumerate or guess stream IDs to intercept sensitive messages, AI-generated responses, and tool invocation data from arbitrary users. The vulnerability was patched in version 0.8.2.
LibreChat 0.8.1-rc2 improperly issues JWT tokens to authenticated users for both the LibreChat API and RAG API without adequate scope separation or validation, enabling token reuse across API boundaries. An authenticated attacker with local access can exploit this misconfiguration to access or manipulate resources in the RAG API using credentials intended only for the main LibreChat API. This authentication bypass affects all deployments of LibreChat 0.8.1-rc2, with a proof-of-concept available via the SBA Research advisory (EUVD-2026-12813), though no active KEV exploitation has been reported at this time.
A critical authentication bypass vulnerability exists in LibreChat version 0.8.1-rc2 where the same JWT secret is reused for both user session management and the RAG (Retrieval-Augmented Generation) API authentication. This design flaw allows authenticated users to compromise service-level authentication of the RAG API by leveraging their session tokens to access or manipulate the RAG service beyond intended privileges. No active exploitation (KEV) has been reported, but a detailed security advisory with technical analysis is publicly available from SBA Research.
LibreChat versions prior to 0.8.3-rc1 contain a Denial of Service vulnerability in the DELETE /api/convos endpoint where authenticated attackers can crash the Node.js server process by sending malformed requests lacking the required req.body.arg parameter. The vulnerability exploits improper destructuring without validation, causing an unhandled TypeError that bypasses Express middleware and triggers process.exit(1), resulting in complete service unavailability. No evidence of active exploitation in the wild or public POC has been identified at this time.
LibreChat 0.8.1-rc2 has SSRF in the Actions feature that allows authenticated users to make the server perform requests to internal networks. By configuring agents with malicious OpenAPI specifications, attackers can scan internal infrastructure and access internal services. PoC available, patch available.
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. [CVSS 4.3 MEDIUM]
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. [CVSS 7.1 HIGH]
Reflected cross-site scripting (CWE-79) affects LibreChat versions 0.8.0 and below because the application has no handler for JSON parsing errors, so the SyntaxError raised by express.json() - which embeds the offending request body - is returned to the client and can be rendered as HTML/JavaScript if the response Content-Type is not strictly enforced. Exploitation is remote and unauthenticated but requires passive user interaction: an attacker must lure a victim into submitting a malformed JSON request containing embedded markup, after which the reflected script executes in the victim's browser session. Publicly available exploit code exists and is referenced by the GitHub advisory, but there is currently no evidence of active exploitation in the wild; EPSS is low at 0.22% (11th percentile) and the assessed impact is limited (C:L/I:L), with no persistence and a fix not available at the time of publication.
LibreChat 0.8.0 and earlier forwards the raw request body of PATCH /api/prompts/groups/:groupId straight into updatePromptGroup() without filtering, letting a caller set fields such as author, authorName, _id, productionId and createdAt that the front end never intends to expose. The result is a moderate-severity mass-assignment and information-disclosure issue (CWE-20; NVD CVSS 5.3), publicly available exploit code exists, and EPSS is low at 0.33% (25th percentile), so this is a genuine but moderate-severity issue rather than a top-tier priority. The vendor-released fix is LibreChat 0.8.1; note that the published CVSS 4.0 vector lists PR:N/UI:P while the vendor's own regression tests exercise the endpoint only after granting PROMPTGROUP_OWNER permission, so the true authentication requirement (likely an authenticated user with write/owner access to the target prompt group) should be confirmed with the vendor.
Stored cross-site scripting and tracker injection in LibreChat 0.8.0 and earlier allow a user who can create a chat to control the iconURL parameter of the chat-creation POST request, persisting an attacker-supplied URL inside the conversation so that anyone who opens a shared link to that chat loads the external resource - enabling privacy loss through tracking beacons and, per the CWE-80 classification, HTML/script injection in the viewer's browser. The issue is fixed in version 0.8.1 and publicly available exploit details exist in the GitHub security advisory GHSA-84vx-vmcf-xgpp, but EPSS is only 0.21% (11th percentile) with no CISA KEV entry, so real-world exploitation pressure is low. Scoring is contentious: NVD rates it 8.6 under CVSS 4.0 (PR:N), whereas independent assessment rates it moderate under CVSS 3.1 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), because delivery requires a poster with an account, the chat-sharing feature to be enabled, and a victim to actively open the shared link - limiting practical impact to tracking/injected content rather than full account compromise.
LibreChat is a ChatGPT clone with additional features. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unbounded `key` and `value` parameters on the LibreChat 0.7.9 memory API (`POST /api/memories` and `PATCH /api/memories/:key`) allow an attacker to submit arbitrarily large inputs that cause a null pointer error in the Rust-based memory backend, leaving the service unable to create new memories and degrading overall stability. Exploitation is limited in practice to deployments where the memory feature is enabled with a valid memory agent and, because the routes sit behind the `checkMemoryCreate`/`checkMemoryUpdate` middleware, to a valid authenticated session - our assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (7.5), correcting NVD's PR:N rating. Publicly available exploit code exists, published through the huntr bounty program, but there is no confirmation of active exploitation and the issue is not in CISA KEV; it is neutralized once the 100kb payload limit and 1000-character key / 10000-character value checks from the upstream fix are applied.
LibreChat 0.7.9 lets an authenticated user turn off two-factor authentication on their own account without supplying a valid TOTP token or backup code, because the POST /api/auth/2fa/disable handler skips the second-factor verification that the rest of the 2FA flow enforces. The scope is narrow: the endpoint only affects the caller's own account, requires an existing authenticated session on a local-provider account that already had 2FA enabled (PR:L per the vector), and does not enable account takeover - our authoritative assessment therefore scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, far below the published 8.8 vector, which overstates C/I/A. Publicly available exploit code exists (the Huntr bounty write-up), an upstream fix commit is available, and there is no indication of confirmed active exploitation (no CISA KEV listing).
HTML injection in LibreChat 0.7.9 allows an authenticated user to reflect arbitrary markup into the <html lang=""> attribute of a server response by sending a crafted Accept-Language header on an HTTP GET request, which can be escalated into cross-site scripting (XSS) in the browser session that renders the injected page. Publicly available exploit code exists and the issue is documented through a Huntr bounty, but EPSS is only 0.45% (37th percentile) and CVSS 3.1 scores it 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), which our review confirms as a moderate-severity, low-priority issue in practice. The principal limiting factor is that Accept-Language is normally chosen by the requester, so hitting a different victim requires an additional mechanism to set or override that header, such as a malicious proxy, header smuggling, or a client that honors attacker-supplied language preferences.
A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. Public exploit code available.
LibreChat is a ChatGPT clone with additional features. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial of service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In danny-avila/librechat version v0.7.5-rc2, a vulnerability exists in the preset creation functionality where a user can manipulate the user ID field through mass assignment. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
LibreChat through 0.7.4-rc1 has incorrect access control for message updates. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Access-token theft in LibreChat before 0.8.5 lets a malicious MCP (Model Context Protocol) server hijack OAuth tokens minted for a legitimate server, because the client never checks that the RFC 9728 resource parameter matches the configured MCP server URL. Any LibreChat operator who connects their instance to an attacker-controlled MCP server can have the OAuth access tokens intended for a trusted server silently exfiltrated. SSVC rates technical impact as total and a proof-of-concept is referenced, but there is no public exploit weaponization and EPSS exploitation probability is very low (0.11%); it is fixed in 0.8.5.
Authentication-bypass weakness in LibreChat before 0.8.4-rc1 lets an attacker who already holds a valid session silently regenerate all of a victim's two-factor backup codes via POST /api/auth/2fa/backup/regenerate, which never asks for a current TOTP token or an existing backup code. With fresh codes in hand, the attacker can bypass 2FA at login or turn 2FA off entirely, neutralizing the account's second factor. EPSS is low (0.15%, 5th percentile) and no active exploitation is recorded, but proof-of-concept exploitation is acknowledged in the SSVC framework.
Two-factor authentication takeover in LibreChat before 0.8.4-rc1 lets any authenticated user — or an attacker wielding a stolen session token — call the GET /api/auth/2fa/enable endpoint to silently overwrite an account's existing TOTP secret, regenerate backup codes, and flip twoFactorEnabled to false, all without TOTP or backup-code verification. The flaw destroys the victim's working second factor and can lock the legitimate owner out of their own 2FA. Publicly available exploit code exists (SSVC: PoC), but EPSS is low (0.18%, 8th percentile) and it is not listed in CISA KEV.
Information disclosure in LibreChat's Model Context Protocol (MCP) integration allows any authenticated user to exfiltrate critical secrets such as JWT_SECRET and MongoDB credentials by configuring a malicious MCP server URL with environment variable placeholders. The vulnerability affects LibreChat versions up to 0.8.3, and publicly available exploit code exists. While EPSS indicates low exploitation probability (0.03%), the ease of exploitation and high impact make immediate patching critical for deployments with the MCP feature enabled.
Cross-user API key overwrite in LibreChat versions up to and including 0.7.6 allows any authenticated user to replace another user's stored provider API keys (OpenAI, Anthropic, Azure) by injecting a userId parameter into PUT /api/keys requests. The flaw stems from an Insecure Direct Object Reference where the JavaScript spread operator overrides the server-set authenticated user ID, enabling conversation hijacking or denial of service. No public exploit identified at time of analysis, and the issue is fixed in 0.8.3-rc1.
Server-side request forgery in LibreChat 0.8.2-rc2 through 0.8.2 allows authenticated users to access internal network resources via incomplete DNS validation bypass. Despite a prior SSRF patch, the current hostname validation fails to check if DNS resolution points to private IP addresses, enabling attackers to reach internal RAG APIs and cloud metadata endpoints. CVSS 7.7 with network-based attack vector and low complexity. EPSS data not available; no confirmed active exploitation (not listed in CISA KEV). Patch released in version 0.8.3-rc1.
Server-Side Request Forgery (SSRF) in LibreChat versions prior to 0.8.3 allows authenticated users to bypass IP validation and force the application server to make HTTP requests to internal network resources. The vulnerability stems from improper validation of IPv4-mapped IPv6 addresses in hex-normalized form, enabling access to cloud metadata services (AWS 169.254.169.254), loopback addresses, and RFC1918 private networks. With EPSS data unavailable and no CISA KEV listing, no public exploit identified at time of analysis, though the specific bypass technique (hex-normalized IPv4-mapped IPv6) is well-documented in SSRF research.
CVE-2026-4276 is a security vulnerability (CVSS 7.5) that allows attackers. High severity vulnerability requiring prompt remediation.
LibreChat versions 0.8.2 through 0.8.2-rc3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) OAuth callback endpoint that allows attackers to steal OAuth tokens by tricking victims into completing an OAuth flow, resulting in account takeover of the victim's MCP-linked services like Atlassian and Outlook. No active exploitation is known (not in KEV), no POC is publicly available, and EPSS data is not yet available for this newly disclosed vulnerability.
LibreChat before v0.8.2-rc2 allows any authenticated user to execute shell commands as root inside the container through the MCP stdio transport. A single API request is sufficient for root code execution. PoC available, patch available.
Unrestricted file upload to the POST /api/convos/import endpoint in LibreChat prior to 0.8.4-rc1 allows any authenticated user to exhaust server disk space and memory, causing a denial of service. The root cause is an incomplete remediation of CVE-2024-11171: while file size limits were added to the shared multer factory, the import endpoint's independent multer instance was never updated, and the application-level fallback guard (CONVERSATION_IMPORT_MAX_FILE_SIZE_BYTES) is commented out in .env.example by default. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low exploitation complexity for any authenticated user makes this a meaningful operational risk for public-facing or open-registration deployments.
Cross-site scripting in LibreChat's markdown artifact preview pipeline allows an authenticated attacker to inject arbitrary JavaScript into a victim's browser session via crafted image alt text. The marked library v15.0.12 fails to HTML-escape double-quote characters in image alt text when LibreChat's custom image renderer falls through to the built-in renderer, enabling attribute breakout via payloads like `" onload="payload`. The resulting unsanitized HTML is written directly to `innerHTML` inside the Sandpack preview iframe, executing attacker-controlled code in the victim's browser. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; fixed in version 0.8.4-rc1.
LibreChat's POST /api/files/images endpoint lacks the authorization check that was correctly applied to the POST /api/files route in a prior patch, allowing any authenticated user to upload files into arbitrary agents' tool_resources (including context and execute_code environments) without ownership or EDIT permission verification. All LibreChat deployments prior to 0.8.4-rc1 are affected across any multi-user configuration. No active exploitation has been confirmed (not in CISA KEV), but the bypass is trivially exercisable by any valid session holder who knows a target agent ID.
Broken object-level authorization in LibreChat's message deletion endpoint allows any authenticated user to permanently delete messages belonging to other users. Affected are all LibreChat deployments prior to 0.8.4-rc1. By supplying their own valid conversationId for middleware validation while targeting a victim's messageId in the underlying MongoDB query, an attacker bypasses the per-user authorization check and irreversibly removes arbitrary messages. No public exploit or CISA KEV listing exists at time of analysis, but the flaw is straightforward to exploit once a valid messageId is obtained.
Server-side request forgery in LibreChat before 0.8.4-rc1 lets any authenticated user point a custom OpenAI-compatible endpoint baseURL at internal network addresses, because the URL is used to build HTTP requests with no SSRF validation whatsoever - no private-IP blocking, no scheme restriction, and no DNS pinning. By abusing the legitimate custom-endpoint feature, a logged-in user can coerce the server into reaching internal-only services and returning their responses, with a CVSS 3.1 score of 7.7 driven by a changed scope and high confidentiality impact. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the trivial low-complexity nature makes it readily exploitable once an account exists.
Rate limiter bypass in LibreChat prior to 0.8.4-rc1 allows any authenticated user to exhaust server resources via the POST /api/convos/duplicate endpoint, which performs identical expensive database operations as /api/convos/fork but was inadvertently omitted from the CVE-2025-7105 remediation scope. Operators who applied the prior fix may believe resource exhaustion was fully mitigated - they remain exposed through this overlooked parallel endpoint. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low exploitation complexity and bypass nature make this operationally significant for multi-tenant or publicly accessible LibreChat deployments.
Cross-agent file deletion in LibreChat 0.8.3 and earlier allows an authenticated shared-agent editor to permanently destroy files that the owner reuses across multiple agents by calling DELETE /api/files - removing the file globally rather than just from the shared agent context. The owner's private agents, which the editor has no access to, silently retain stale file_id references that no longer resolve, causing integrity and availability degradation across unrelated agents. Exploit proof-of-concept code exists (CVSS E:P); this is not confirmed as actively exploited in CISA KEV, but the low-privilege network-accessible attack path warrants prompt patching to 0.8.4.
LibreChat's MCP server configuration API leaks decrypted admin-managed credentials - including plaintext API keys and OAuth client secrets - to any authenticated user holding only VIEW-level access to a shared MCP server. All deployments running versions up to and including 0.8.3 are affected, with the flaw accessible via standard GET requests to `/api/mcp/servers` and `/api/mcp/servers/:serverName`. No public exploit or active exploitation has been identified at time of analysis, but the low-complexity, low-privilege network vector makes credential exfiltration straightforward in any multi-user LibreChat environment.
Arbitrary file write in LibreChat prior to 0.8.4 allows authenticated users to overwrite arbitrary server files via path traversal in code artifact filenames. The vulnerability affects LibreChat deployments using the default local file storage strategy, where the execute_code sandbox returns a user-controllable filename that is concatenated directly into the file write path without sanitization. An authenticated attacker can craft malicious artifact names containing traversal sequences (e.g., ../../../../../app/client/dist/poc.txt) to write files outside the intended directory, potentially compromising application integrity or enabling remote code execution through client-side file injection.
LibreChat versions 0.8.2-rc1 through 0.8.3-rc1 leak OAuth access tokens when authenticated users interact with malicious MCP servers, which can inject credential placeholders into HTTP headers that are automatically substituted with sensitive tokens. An attacker can create a rogue MCP server containing headers like {{LIBRECHAT_OPENID_ACCESS_TOKEN}} to harvest victim credentials during tool execution; the vulnerability is fixed in version 0.8.3-rc2. No public exploit code or CISA KEV listing is documented, but the attack requires user interaction (UI:R) and authenticated access (PR:L), limiting real-world impact.
Unauthenticated stream hijacking in LibreChat versions 0.8.2-rc2 through 0.8.2-rc3 allows authenticated users to read other users' real-time chat conversations via the SSE streaming endpoint `/api/agents/chat/stream/:streamId` without ownership verification. An attacker with valid credentials can enumerate or guess stream IDs to intercept sensitive messages, AI-generated responses, and tool invocation data from arbitrary users. The vulnerability was patched in version 0.8.2.
LibreChat 0.8.1-rc2 improperly issues JWT tokens to authenticated users for both the LibreChat API and RAG API without adequate scope separation or validation, enabling token reuse across API boundaries. An authenticated attacker with local access can exploit this misconfiguration to access or manipulate resources in the RAG API using credentials intended only for the main LibreChat API. This authentication bypass affects all deployments of LibreChat 0.8.1-rc2, with a proof-of-concept available via the SBA Research advisory (EUVD-2026-12813), though no active KEV exploitation has been reported at this time.
A critical authentication bypass vulnerability exists in LibreChat version 0.8.1-rc2 where the same JWT secret is reused for both user session management and the RAG (Retrieval-Augmented Generation) API authentication. This design flaw allows authenticated users to compromise service-level authentication of the RAG API by leveraging their session tokens to access or manipulate the RAG service beyond intended privileges. No active exploitation (KEV) has been reported, but a detailed security advisory with technical analysis is publicly available from SBA Research.
LibreChat versions prior to 0.8.3-rc1 contain a Denial of Service vulnerability in the DELETE /api/convos endpoint where authenticated attackers can crash the Node.js server process by sending malformed requests lacking the required req.body.arg parameter. The vulnerability exploits improper destructuring without validation, causing an unhandled TypeError that bypasses Express middleware and triggers process.exit(1), resulting in complete service unavailability. No evidence of active exploitation in the wild or public POC has been identified at this time.
LibreChat 0.8.1-rc2 has SSRF in the Actions feature that allows authenticated users to make the server perform requests to internal networks. By configuring agents with malicious OpenAPI specifications, attackers can scan internal infrastructure and access internal services. PoC available, patch available.
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. [CVSS 4.3 MEDIUM]
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. [CVSS 7.1 HIGH]
Reflected cross-site scripting (CWE-79) affects LibreChat versions 0.8.0 and below because the application has no handler for JSON parsing errors, so the SyntaxError raised by express.json() - which embeds the offending request body - is returned to the client and can be rendered as HTML/JavaScript if the response Content-Type is not strictly enforced. Exploitation is remote and unauthenticated but requires passive user interaction: an attacker must lure a victim into submitting a malformed JSON request containing embedded markup, after which the reflected script executes in the victim's browser session. Publicly available exploit code exists and is referenced by the GitHub advisory, but there is currently no evidence of active exploitation in the wild; EPSS is low at 0.22% (11th percentile) and the assessed impact is limited (C:L/I:L), with no persistence and a fix not available at the time of publication.
LibreChat 0.8.0 and earlier forwards the raw request body of PATCH /api/prompts/groups/:groupId straight into updatePromptGroup() without filtering, letting a caller set fields such as author, authorName, _id, productionId and createdAt that the front end never intends to expose. The result is a moderate-severity mass-assignment and information-disclosure issue (CWE-20; NVD CVSS 5.3), publicly available exploit code exists, and EPSS is low at 0.33% (25th percentile), so this is a genuine but moderate-severity issue rather than a top-tier priority. The vendor-released fix is LibreChat 0.8.1; note that the published CVSS 4.0 vector lists PR:N/UI:P while the vendor's own regression tests exercise the endpoint only after granting PROMPTGROUP_OWNER permission, so the true authentication requirement (likely an authenticated user with write/owner access to the target prompt group) should be confirmed with the vendor.
Stored cross-site scripting and tracker injection in LibreChat 0.8.0 and earlier allow a user who can create a chat to control the iconURL parameter of the chat-creation POST request, persisting an attacker-supplied URL inside the conversation so that anyone who opens a shared link to that chat loads the external resource - enabling privacy loss through tracking beacons and, per the CWE-80 classification, HTML/script injection in the viewer's browser. The issue is fixed in version 0.8.1 and publicly available exploit details exist in the GitHub security advisory GHSA-84vx-vmcf-xgpp, but EPSS is only 0.21% (11th percentile) with no CISA KEV entry, so real-world exploitation pressure is low. Scoring is contentious: NVD rates it 8.6 under CVSS 4.0 (PR:N), whereas independent assessment rates it moderate under CVSS 3.1 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), because delivery requires a poster with an account, the chat-sharing feature to be enabled, and a victim to actively open the shared link - limiting practical impact to tracking/injected content rather than full account compromise.
LibreChat is a ChatGPT clone with additional features. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unbounded `key` and `value` parameters on the LibreChat 0.7.9 memory API (`POST /api/memories` and `PATCH /api/memories/:key`) allow an attacker to submit arbitrarily large inputs that cause a null pointer error in the Rust-based memory backend, leaving the service unable to create new memories and degrading overall stability. Exploitation is limited in practice to deployments where the memory feature is enabled with a valid memory agent and, because the routes sit behind the `checkMemoryCreate`/`checkMemoryUpdate` middleware, to a valid authenticated session - our assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (7.5), correcting NVD's PR:N rating. Publicly available exploit code exists, published through the huntr bounty program, but there is no confirmation of active exploitation and the issue is not in CISA KEV; it is neutralized once the 100kb payload limit and 1000-character key / 10000-character value checks from the upstream fix are applied.
LibreChat 0.7.9 lets an authenticated user turn off two-factor authentication on their own account without supplying a valid TOTP token or backup code, because the POST /api/auth/2fa/disable handler skips the second-factor verification that the rest of the 2FA flow enforces. The scope is narrow: the endpoint only affects the caller's own account, requires an existing authenticated session on a local-provider account that already had 2FA enabled (PR:L per the vector), and does not enable account takeover - our authoritative assessment therefore scores it CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, far below the published 8.8 vector, which overstates C/I/A. Publicly available exploit code exists (the Huntr bounty write-up), an upstream fix commit is available, and there is no indication of confirmed active exploitation (no CISA KEV listing).
HTML injection in LibreChat 0.7.9 allows an authenticated user to reflect arbitrary markup into the <html lang=""> attribute of a server response by sending a crafted Accept-Language header on an HTTP GET request, which can be escalated into cross-site scripting (XSS) in the browser session that renders the injected page. Publicly available exploit code exists and the issue is documented through a Huntr bounty, but EPSS is only 0.45% (37th percentile) and CVSS 3.1 scores it 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), which our review confirms as a moderate-severity, low-priority issue in practice. The principal limiting factor is that Accept-Language is normally chosen by the requester, so hitting a different victim requires an additional mechanism to set or override that header, such as a malicious proxy, header smuggling, or a client that honors attacker-supplied language preferences.
A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. Public exploit code available.
LibreChat is a ChatGPT clone with additional features. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial of service. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In danny-avila/librechat version v0.7.5-rc2, a vulnerability exists in the preset creation functionality where a user can manipulate the user ID field through mass assignment. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
LibreChat through 0.7.4-rc1 has incorrect access control for message updates. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.