LibreChat <= 0.7.9 - HTML Injection via Accept-Language Header

danny-avila/librechat 0.7.9 contains a stored XSS caused by improper sanitization of the Accept-Language header, letting logged-in users inject arbitrary HTML into the html lang= tag, exploit requires user to be logged in. id: CVE-2025-8848 info: name: LibreChat marker"...

GHSA-C6GR-QVV4-5V3F vulnerabilities

Vulnerabilities for packages: librechat, wazuh-dashboard, langfuse-fips, wazuh-dashboard-fips, opensearch-dashboards, opensearch-dashboards-fips, langfuse, awx, gitlab-rails-ce, nextcloud-server, gitlab-rails-ce-fips, supabase...

GHSA-CG2G-XH64-V4Q7 vulnerabilities

Vulnerabilities for packages: librechat, wazuh-dashboard, langfuse-fips, wazuh-dashboard-fips, opensearch-dashboards, opensearch-dashboards-fips, langfuse, awx, gitlab-rails-ce, nextcloud-server, gitlab-rails-ce-fips, supabase...

GHSA-MRV2-3PQR-J5JR vulnerabilities

Vulnerabilities for packages: librechat, wazuh-dashboard, langfuse-fips, wazuh-dashboard-fips, opensearch-dashboards, opensearch-dashboards-fips, langfuse, awx, gitlab-rails-ce, nextcloud-server, gitlab-rails-ce-fips, supabase...

GHSA-C9RX-X947-FP3H vulnerabilities

Vulnerabilities for packages: librechat, saf...

CVE-2026-113650 vulnerabilities

Vulnerabilities for packages: librechat, saf...

GHSA-QQMP-WF37-98F9 vulnerabilities

Vulnerabilities for packages: kibana, azurite, zitadel, librechat...

CVE-2026-104872 vulnerabilities

Vulnerabilities for packages: kibana, azurite, zitadel, librechat...

CVE-2026-90776 vulnerabilities

Vulnerabilities for packages: librechat, langfuse, unleash-fips, langfuse-fips...

GHSA-VM5R-23W9-M8HX vulnerabilities

Vulnerabilities for packages: librechat, langfuse, unleash-fips, langfuse-fips...

GHSA-3WCJ-GJVF-FVCH vulnerabilities

Vulnerabilities for packages: librechat, langfuse-fips, kibana, opensearch-dashboards, opensearch-dashboards-fips, langfuse...

CVE-2026-56763 vulnerabilities

Vulnerabilities for packages: librechat, langfuse-fips, kibana, opensearch-dashboards, opensearch-dashboards-fips, langfuse...

GHSA-JXRP-R7GX-Q4J8 vulnerabilities

Vulnerabilities for packages: librechat, wazuh-dashboard, langfuse-fips, kibana, wazuh-dashboard-fips, opensearch-dashboards, opensearch-dashboards-fips, langfuse, awx, jupyter-base-notebook, tensorflow-gpu-jupyter, gitlab-rails-ce, nextcloud-server, gitlab-rails-ce-fips...

CVE-2026-66010 vulnerabilities

Vulnerabilities for packages: librechat, wazuh-dashboard, langfuse-fips, kibana, wazuh-dashboard-fips, opensearch-dashboards, opensearch-dashboards-fips, langfuse, awx, jupyter-base-notebook, tensorflow-gpu-jupyter, gitlab-rails-ce, nextcloud-server, gitlab-rails-ce-fips...

GHSA-6623-4Q32-82V8 vulnerabilities

Vulnerabilities for packages: librechat, wazuh-dashboard, wazuh-dashboard-fips, commercial-gitlab-rails-ee-fips, supabase-fips, commercial-gitlab-rails-ee, supabase...

GHSA-PRGH-XP8R-P3M5 vulnerabilities

Vulnerabilities for packages: librechat, langfuse, unleash-fips, langfuse-fips...

GHSA-HXH3-VQPV-XPQV vulnerabilities

Vulnerabilities for packages: librechat, wazuh-dashboard, wazuh-dashboard-fips, commercial-gitlab-rails-ee-fips, supabase-fips, commercial-gitlab-rails-ee, supabase...

CVE-2026-93981 vulnerabilities

Vulnerabilities for packages: librechat, wazuh-dashboard, wazuh-dashboard-fips, commercial-gitlab-rails-ee-fips, supabase-fips, commercial-gitlab-rails-ee, supabase...

CVE-2026-101899 vulnerabilities

Vulnerabilities for packages: kubeflow-centraldashboard, semaphore, langfuse-fips, wazuh-dashboard-fips, commercial-gitlab-rails-ee, lerna, lambda-nodejs, gitlab-rails-ce-fips, librechat, wazuh-dashboard, redisinsight, kibana, commercial-gitlab-rails-ee-fips, opensearch-dashboards, prism,...

GHSA-542G-H47M-68V8 vulnerabilities

Vulnerabilities for packages: kubeflow-centraldashboard, semaphore, langfuse-fips, wazuh-dashboard-fips, commercial-gitlab-rails-ee, lerna, lambda-nodejs, gitlab-rails-ce-fips, librechat, wazuh-dashboard, redisinsight, kibana, commercial-gitlab-rails-ee-fips, opensearch-dashboards, prism,...