Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-12580Logs Debug Injection in danny-avila/librechat

Medium 4.3

In plain English

A medium-severity security flaw in danny-avila/librechat from danny-avila. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).

Severity (CVSS 3.0)4.3Medium

Exploit odds (30 days)0.5%top 56.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and file_id in the /code/download/:sessionId/:fileId and /download/:userId/:file_id APIs are not validated or filtered, leading to potential log injection attacks. This can cause distortion of monitoring and investigation information, evade detection from security systems, and create difficulties in maintenance and operation.

Affected products (as reported)

Vendor	Product	Versions
danny-avila	danny-avila/librechat	unspecified – before 0.7.6

Weakness: CWE-117 · Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

In plain English

Official description

Affected products (as reported)

References