LibreChat <= 0.7.9 - HTML Injection via Accept-Language Header

danny-avila/librechat 0.7.9 contains a stored XSS caused by improper sanitization of the Accept-Language header, letting logged-in users inject arbitrary HTML into the html lang= tag, exploit requires user to be logged in. id: CVE-2025-8848 info: name: LibreChat marker"...

CVE-2026-59876 vulnerabilities

Vulnerabilities for packages: librechat...

GHSA-JFJ6-75FJ-8934 vulnerabilities

Vulnerabilities for packages: librechat...

GHSA-F88M-G3JW-G9CJ vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, librechat, homepage...

CVE-2026-65899 vulnerabilities

Vulnerabilities for packages: langfuse, kibana, langfuse-fips, librechat, nextcloud-server, opensearch-dashboards, wazuh-dashboard-fips, wazuh-dashboard...

CVE-2026-65898 vulnerabilities

Vulnerabilities for packages: langfuse, kibana, langfuse-fips, librechat, nextcloud-server, opensearch-dashboards, wazuh-dashboard-fips, wazuh-dashboard, opensearch-dashboards-fips...

CVE-2026-65903 vulnerabilities

Vulnerabilities for packages: langfuse, kibana, langfuse-fips, librechat, nextcloud-server, opensearch-dashboards, wazuh-dashboard-fips, wazuh-dashboard, opensearch-dashboards-fips...

CVE-2026-65901 vulnerabilities

Vulnerabilities for packages: langfuse, kibana, langfuse-fips, librechat, nextcloud-server, wazuh-dashboard-fips, wazuh-dashboard...

CVE-2026-65900 vulnerabilities

Vulnerabilities for packages: langfuse, kibana, langfuse-fips, librechat, nextcloud-server, wazuh-dashboard-fips, wazuh-dashboard...

CVE-2026-65902 vulnerabilities

Vulnerabilities for packages: langfuse, kibana, langfuse-fips, librechat, nextcloud-server, wazuh-dashboard-fips, wazuh-dashboard...

GHSA-94RC-8X27-4472 vulnerabilities

Vulnerabilities for packages: librechat...

CVE-2026-54270 vulnerabilities

Vulnerabilities for packages: librechat...

CVE-2026-56761 vulnerabilities

Vulnerabilities for packages: langfuse, kibana, langfuse-fips, librechat, wazuh-dashboard...

CVE-2026-54037

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2025-7105 added forkIpLimiter and forkUserLimiter rate limiters to POST /api/convos/fork to prevent rapid-fire conversation duplication. However, the POST /api/convos/duplicate endpoint...

CVE-2026-54024

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2024-11171 commit bb58a2d0 added limits: fileSize to createMulterInstance in the file upload routes. However, the POST /api/convos/import endpoint uses a separate multer instance that w...

CVE-2026-54025

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, there is a vulnerability in LibreChat's markdown artifact preview pipeline. The marked library v15.0.12 does not HTML-escape double-quote characters in image alt text when a custom renderer falls throu...

CVE-2026-54030

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5, LibreChat's MCP OAuth implementation does not validate that the resource parameter from OAuth Protected Resource metadata RFC 9728 matches the configured MCP server URL, allowing a malicious MCP server to...

CVE-2026-54029

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the DELETE /api/messages/:conversationId/:messageId endpoint allows any authenticated user to delete any other user's messages. The validateMessageReq middleware only validates that the conversationId...

CVE-2026-54033

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-compatible API endpoints by setting a baseURL. This URL is used to construct HTTP requests without any SSRF validation — no private IP check, no scheme...

CVE-2026-54027

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/images endpoint allows any authenticated user to upload files into any agent's toolresources e.g., context, executecode without verifying ownership or EDIT permission on the target...