PT-2026-1934

Name of the Vulnerable Software and Affected Versions LibreChat version 0.8.1-rc2 Description LibreChat, a ChatGPT clone with additional features, is susceptible to a server-side request forgery SSRF issue. This occurs because of missing restrictions within the Actions feature in its default...

LibreChat 代码问题漏洞

LibreChat is a free, highly customizable, unified AI conversation platform open-sourced by LibreChat, capable of aggregating and running large models from any vendor in a single interface. A code issue vulnerability exists in LibreChat version 0.8.1-rc2, which stems from a missing restriction in...

LibreChat 安全漏洞

LibreChat is a free, highly customizable, unified AI conversation platform open-sourced by LibreChat, capable of aggregating and running large models from any vendor in a single interface. A security vulnerability exists in LibreChat version 0.8.1-rc2, which stems from improper access control whe...

CVE-2025-69221: Missing Authorization

LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. An authenticated attacker can read the permissions of arbitrary agents, even if they have no permissions for this agent. LibreChat allows the...

CVE-2025-69222: Server-Side Request Forgery (SSRF)

LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 is prone to a server-side request forgery SSRF vulnerability due to missing restrictions of the Actions feature in the default configuration. LibreChat enables users to configure agents with predefined instructions and actio...

PT-2026-1932

Name of the Vulnerable Software and Affected Versions LibreChat versions prior to 0.8.2-rc2 Description LibreChat, a ChatGPT clone, does not properly control access when uploading files to an agent's file context or during file searches in version 0.8.1-rc2. An authenticated attacker who knows an...

LibreChat 安全漏洞

LibreChat is a free, highly customizable, unified AI conversation platform open-sourced by LibreChat, capable of aggregating and running large models from any vendor in a single interface. A security vulnerability exists in LibreChat version 0.8.1-rc2, which stems from improper access control for...

PT-2026-1933

Name of the Vulnerable Software and Affected Versions LibreChat versions prior to 0.8.2-rc2 Description LibreChat, a ChatGPT clone with additional features, does not properly enforce access control when querying agent permissions in version 0.8.1-rc2. An authenticated attacker can read the...

CVE-2025-69220: Missing Authorization

LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. An authenticated attacker with access to the agent ID can change the behavior of arbitrary agents by uploading new files to t...

CVE-2025-68665 vulnerabilities

Vulnerabilities for packages: librechat, kibana, langfuse-fips, langfuse...

GHSA-R399-636X-V7F6 vulnerabilities

Vulnerabilities for packages: librechat, kibana, langfuse-fips, langfuse...

The vulnerability of the LibreChat artificial intelligence-based platform, related to deficiencies in the authentication process, allows a violator to gain unauthorized access to protected information.

The vulnerability of the LibreChat artificial intelligence-based platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the LibreChat artificial intelligence-based platform, related to uncontrolled resource consumption, allows a violator to trigger a service failure.

The vulnerability of the LibreChat artificial intelligence-based platform is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2025-66450 vulnerabilities

Vulnerabilities for packages: librechat...

CVE-2025-66451 vulnerabilities

Vulnerabilities for packages: librechat...

CVE-2025-66452 vulnerabilities

Vulnerabilities for packages: librechat...

CVE-2025-66452

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, there is no handler for JSON parsing errors; SyntaxError from express.json includes user input in the error message, which gets reflected in responses. User input including HTML/JavaScript can be exposed in error...

CVE-2025-66451

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when creating prompts, JSON requests are sent to define and modify the prompts via PATCH endpoint for prompt groups /api/prompts/groups/:groupId. However, the request bodies are not sufficiently validated for prop...

CVE-2025-66450

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when a user posts a question, the iconURL parameter of the POST request can be modified by an attacker. The malicious code is then stored in the chat which can then be shared to other users. When sharing chats wit...

CVE-2025-66451

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when creating prompts, JSON requests are sent to define and modify the prompts via PATCH endpoint for prompt groups /api/prompts/groups/:groupId. However, the request bodies are not sufficiently validated for prop...