danny-avila LibreChat

• CVE-2026-54024 Medium 6.5 LibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limits 0.4%
• CVE-2026-54025 Medium 5.4 LibreChat: Stored XSS via unescaped image alt text in markdown artifact preview 0.2%
• CVE-2026-54027 Medium 6.5 LibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorization 0.3%
• CVE-2026-54029 Medium 5.3 LibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filter 0.3%
• CVE-2026-54033 High 7.7 LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs 0.4%
• CVE-2026-54037 Medium 6.5 LibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/fork 0.5%
• CVE-2026-54030 High 8.0 LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow 0.2%
• CVE-2026-54040 Medium 5.9 LibreChat: 2FA Backup Code Regeneration Without OTP Verification Allows 2FA Bypass 0.3%
• CVE-2026-54036 Medium 5.3 LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification 0.4%
• CVE-2026-44654 Medium 5.7 LibreChat: Shared-agent editor can globally delete owner's file records — breaks owner's other private agents 0.3%
• CVE-2026-44653 Medium 6.5 LibreChat Shared MCP Server View Leaks Decrypted Admin Secrets 0.3%
• CVE-2026-32625 Critical 9.6 LibreChat Exfiltrates Server Secrets via MCP Server URL Injection 2.8%
• CVE-2026-31942 High 7.1 LibreChat has IDOR in API Keys Management that allows any authenticated user to overwrite other users' API keys 0.2%
• CVE-2026-34371 Medium 6.3 LibreChat Affected by Arbitrary File Write via `execute_code` Artifact Filename Traversal 0.3%
• CVE-2026-31951 Medium 6.8 LibreChat's MCP Server Header Injection Enables OAuth Token Theft 0.3%
• CVE-2026-31950 Medium 5.3 LibreChat's IDOR in SSE Stream Subscription Allows Reading Other Users' Chats 0.2%
• CVE-2026-31945 High 7.7 LibreChat Server-Side Request Forgery using DNS resolution 0.3%
• CVE-2026-31943 High 8.5 LibreChat has SSRF protection bypass via IPv4-mapped IPv6 normalization in isPrivateIP 0.2%
• CVE-2025-41258 High 8.0 LibreChat RAG API Authentication Bypass 0.3%
• CVE-2026-31949 Medium 6.5 LibreChat Denial of Service (DoS) via Unhandled Exception in DELETE /api/convos 0.4%
• CVE-2026-31944 High 7.6 LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect link 0.3%
• CVE-2026-22252 Critical 9.1 LibreChat MCP Stdio Remote Command Execution 4.2%
• CVE-2025-69222 Critical 9.1 LibreChat is vulnerable to Server-Side Request Forgery due to missing restrictions 4.6%
• CVE-2025-69221 Medium 4.3 LibreChat has Insufficient Access Control for Agent Permission Queries 0.3%
• CVE-2025-69220 High 7.1 LibreChat has Insufficient Access Control for Agent Files 0.3%
• CVE-2025-66452 Medium 5.3 LibreChat's lack of JSON parsing error handling can lead to XSS 0.2%
• CVE-2025-66451 Medium 5.3 LibreChat's Improper Input Validation in Prompt Creation API Enables Unauthorized Permission Changes 0.3%
• CVE-2025-66450 High 8.6 LibreChat JSON Injection in Chat POST Allows Remote Resource Inclusion and PXSS via Image Upload 0.2%
• CVE-2025-66201 High 8.6 LibreChat is Vulnerable to Server-Side Request Forgery (SSRF) in Actions Capability 0.3%
• CVE-2025-54868 High 7.5 LibreChat exposes arbitrary chats through Meilisearch engine 0.5%