LibreChat 安全漏洞

LibreChat is an enhanced ChatGPT clone by Danny Avila Personal Developer. A security vulnerability exists in LibreChat versions prior to 0.7.6, which stems from an unvalidated parameter and could lead to a log injection attack...

PT-2025-12103

Name of the Vulnerable Software and Affected Versions danny-avila/librechat versions prior to 0.7.6 Description The issue occurs when certain API endpoints receive malformed input, resulting in an uncaught exception, which can cause the server to crash and lead to a full denial of service. Althou...

LibreChat 安全漏洞

LibreChat is an enhanced ChatGPT clone. A denial-of-service vulnerability exists in LibreChat that stems from certain API endpoints not handling incorrectly formatted input when received, which can be exploited by an attacker to cause the server to crash...

CVE-2024-11171: Allocation of Resources Without Limits or Throttling

In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipart file uploads. When using in-memory storage the default setting for multer, there is no limit on the upload file size. This can lead to a...

CVE-2024-10366: Authorization Bypass Through User-Controlled Key

An improper access control vulnerability IDOR exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other use...

CVE-2024-10361: Improper Limitation of a Pathname to a Restricted Directory

An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit thi...

CVE-2024-11169: Misinterpretation of Input

An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an exception while handling file uploads. An unauthenticated user can trigger this exception by sending a specially crafted request, causing the server to crash...

PT-2025-12039

Name of the Vulnerable Software and Affected Versions danny-avila/LibreChat version 0.7.5 Description The issue is related to improper access control, allowing users to share, use, and create prompts without permission from the admin. This can lead to unauthorized actions and break application...

CVE-2024-11170: Path Traversal: '\..\filename'

A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6...

CVE-2024-12580: Improper Output Neutralization for Logs

A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and fileid in the /code/download/:sessionId/:fileId and /download/:userId/:fileid APIs are not validated or filtered, leading to potential log injection...

LibreChat 资源管理错误漏洞

LibreChat is an enhanced ChatGPT clone. LibreChat suffers from a denial of service vulnerability that can be exploited by an attacker to cause a server crash...

CVE-2024-10359: Improperly Controlled Modification of Dynamically-Determined Object Attributes

In danny-avila/librechat version v0.7.5-rc2, a vulnerability exists in the preset creation functionality where a user can manipulate the user ID field through mass assignment. This allows an attacker to inject a different user ID into the preset object, causing the preset to appear in the UI of...

CVE-2024-11173: Uncaught Exception

An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial of service. This issue occurs when certain API endpoints receive malformed input, resulting in an uncaught exception. Although a valid JWT is required to...

CVE-2024-11172: Uncaught Exception

A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. The middleware checkBan is not surrounded by a try-catch block, and an unhandled exception will cause the server to crash. This...

The vulnerability in the checkBan.js script of the LibreChat artificial intelligence-based platform allows a violator to trigger a service denial.

The vulnerability of the checkBan.js script on the LibreChat AI-based platform involves an uncontrolled consumption of resources. Exploiting this vulnerability could allow a malicious actor to cause service failures...

multer(file upload middleware in express) misused, lead to remote code execution

Description Librechat use multer to handle multi-part file upload. multer library will deal with '../' kind of path traversal, then let the programmer decide the actual filename, then join the path to write the upload the file. this means, if '../' is provided by the user of librechat, multer wil...

Not limitation of upload file size, lead to server crash

Description librechat use multer, which is a middleware which handles streaming multipart fileupload. If use in memory storagemulter by default, can do not limit the upload file size, when handling big file, server will crash for out of memory. Attacker with no privilege can exploit this. Proof o...

PT-2024-10343

Name of the Vulnerable Software and Affected Versions LibreChat affected versions not specified Description The issue is related to an uncontrolled resource consumption in the checkBan.js script of the LibreChat platform, which is based on artificial intelligence. This could allow a remote attack...

unhandled exception caused server crash

Description in javascript express framework, if async router handler throw an exception, the whole server will crash. In librechat, some API, when leading with some malformed input, will have uncaught exception. This will lead to server crash, thus a full denial of service. Mind that although thi...

Allowing execution user provided regexp, lead to Redos

Description librechat have a functionality of uploading chatgpt chat log. when processing the log, following code is executed: const pattern = new RegExp \u3010$citation.metadata.extra.citedmessageidx\u2020.+?\u3011, 'g', ; const replacement = $citation.metadata.title; messageText =...