GHSA-6WQW-2P9W-4VW4 vulnerabilities

Vulnerabilities for packages: langfuse-fips, langfuse, librechat...

CVE-2026-24771 vulnerabilities

Vulnerabilities for packages: langfuse-fips, langfuse, librechat...

CVE-2026-24473 vulnerabilities

Vulnerabilities for packages: langfuse-fips, langfuse, librechat...

CVE-2026-24472 vulnerabilities

Vulnerabilities for packages: langfuse-fips, langfuse, librechat...

CVE-2026-24398 vulnerabilities

Vulnerabilities for packages: langfuse-fips, langfuse, librechat...

CVE-2026-25547 vulnerabilities

Vulnerabilities for packages: actions-runner, lerna, node-gyp, pulumi, sqlpad, renovate, librechat, drupal, npm...

CVE-2025-14874 vulnerabilities

Vulnerabilities for packages: librechat, kibana, langfuse, jitsucom-jitsu...

CVE-2025-7105

A vulnerability in danny-avila/librechat allows attackers to exploit the unrestricted Fork Function in /api/convos/fork to fork numerous contents rapidly. If the forked content includes a Mermaid graph with a large number of nodes, it can lead to a JavaScript heap out of memory error upon service...

CVE-2025-7105

The CVE-2025-7105 entry concerns danny-avila/librechat where an unrestricted Fork Function at /api/convos/fork allows rapid forking of content. If a forked item contains a Mermaid graph with many nodes, a JavaScript heap out of memory error can occur on service restart, causing a Denial of Servic...

EUVD-2025-206617

A vulnerability in danny-avila/librechat allows attackers to exploit the unrestricted Fork Function in /api/convos/fork to fork numerous contents rapidly. If the forked content includes a Mermaid graph with a large number of nodes, it can lead to a JavaScript heap out of memory error upon service...

CVE-2025-7105 Denial of Service via JavaScript Memory Overflow in danny-avila/librechat

A vulnerability in danny-avila/librechat allows attackers to exploit the unrestricted Fork Function in /api/convos/fork to fork numerous contents rapidly. If the forked content includes a Mermaid graph with a large number of nodes, it can lead to a JavaScript heap out of memory error upon service...

CVE-2025-7105 Denial of Service via JavaScript Memory Overflow in danny-avila/librechat

A vulnerability in danny-avila/librechat allows attackers to exploit the unrestricted Fork Function in /api/convos/fork to fork numerous contents rapidly. If the forked content includes a Mermaid graph with a large number of nodes, it can lead to a JavaScript heap out of memory error upon service...

CVE-2025-7105 Denial of Service via JavaScript Memory Overflow in danny-avila/librechat

A vulnerability in danny-avila/librechat allows attackers to exploit the unrestricted Fork Function in /api/convos/fork to fork numerous contents rapidly. If the forked content includes a Mermaid graph with a large number of nodes, it can lead to a JavaScript heap out of memory error upon service...

CVE-2026-22252 vulnerabilities

Vulnerabilities for packages: librechat...

📄 LibreChat MCP 0.8.2-rc2 Remote Code Execution

This proof of concept exploit targets the LibreChat MCP remote code execution vulnerability known as CVE-2026-22252. It provides a comprehensive and professional framework for detecting, testing, and exploiting the vulnerability with multiple extraction modes...

📄 LibreChat MCP 0.8.2-rc2 Remote Code Execution

Proof of concept exploit for a remote code execution vulnerability in LibreChat MCP version 0.8.2-rc2 that leverages an unsanitized stdio server configuration issue...

CVE-2025-69222 vulnerabilities

Vulnerabilities for packages: librechat...

CVE-2025-69221 vulnerabilities

Vulnerabilities for packages: librechat...

CVE-2026-22252

LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbitrary commands without validation, allowing any authenticated user to execute shell commands as root inside the container through a single API request. This vulnerability is fix...

CVE-2026-22252

LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbitrary commands without validation, allowing any authenticated user to execute shell commands as root inside the container through a single API request. This vulnerability is fix...