Librechat

Librechat

29 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.4

CVE-2025-8848

Exploit
  • EPSS 0.03%
  • Veröffentlicht 22.10.2025 13:54:00
  • Zuletzt bearbeitet 30.10.2025 17:34:52

A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the <html lang...

7.5

CVE-2025-7104

Exploit
  • EPSS 0.04%
  • Veröffentlicht 29.09.2025 17:15:32
  • Zuletzt bearbeitet 16.10.2025 16:45:42

A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by automatically binding user-provided data to internal object properties or database fields w...

5.3

CVE-2025-7106

  • EPSS 0.03%
  • Veröffentlicht 23.09.2025 10:15:34
  • Zuletzt bearbeitet 20.10.2025 19:00:25

danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The `checkAccess` function in `api/server/middleware/roles/access.js` uses `permissions.some()` to validate permissions, which incorrect...

3.1

CVE-2025-6088

Exploit
  • EPSS 0.03%
  • Veröffentlicht 11.09.2025 00:43:51
  • Zuletzt bearbeitet 16.10.2025 16:00:19

In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated ser...

7.5

CVE-2025-54868

Exploit
  • EPSS 0.07%
  • Veröffentlicht 05.08.2025 04:53:08
  • Zuletzt bearbeitet 26.08.2025 13:41:36

LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly from the Meilisearch engine. The endpoint /api/search/test allows for direct access to sto...

4.6

CVE-2024-10359

Exploit
  • EPSS 0.12%
  • Veröffentlicht 20.03.2025 10:10:44
  • Zuletzt bearbeitet 11.07.2025 20:32:31

In danny-avila/librechat version v0.7.5-rc2, a vulnerability exists in the preset creation functionality where a user can manipulate the user ID field through mass assignment. This allows an attacker to inject a different user ID into the preset obje...

6.5

CVE-2024-11173

Exploit
  • EPSS 0.23%
  • Veröffentlicht 20.03.2025 10:10:33
  • Zuletzt bearbeitet 15.07.2025 16:03:30

An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial of service. This issue occurs when certain API endpoints receive malformed input, resulting in an uncaught ex...

5.4

CVE-2024-10363

Exploit
  • EPSS 0.08%
  • Veröffentlicht 20.03.2025 10:10:19
  • Zuletzt bearbeitet 15.10.2025 13:15:35

In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthori...

7.5

CVE-2024-11171

Exploit
  • EPSS 0.21%
  • Veröffentlicht 20.03.2025 10:10:18
  • Zuletzt bearbeitet 15.10.2025 13:15:38

In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipart file uploads. When using in-memory storage (the default setting for multer), there is no ...

7.5

CVE-2024-11172

Exploit
  • EPSS 0.31%
  • Veröffentlicht 20.03.2025 10:10:06
  • Zuletzt bearbeitet 15.10.2025 13:15:39

A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. The middleware `checkBan` is not surrounded by a try-catch block, and an unhandle...