CVE-2026-4276

The LibreChat RAG API , version 0.7.0 , is vulnerable to a log-injection flaw caused by improper sanitization of user-supplied input before it is recorded in system logs. An authenticated attacker can exploit this by inserting CRLF (carriage-return/line-feed) characters into the file_id parameter...