librechat has 12 CVEs on record between 2025 and 2026. The busiest recent month was December 2025 with 3. The median CVSS is 6.8 (medium), with 1 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-284 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.8
- Publish → KEV
- —
- Last 90 days
- 0 prev 0
Worst active — by depth score
CVE-2025-69222Critical· 9.1LibreChat is a ChatGPT clone with additional features51CVE-2025-8850High· 8.8In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow48CVE-2025-66201High· 8.1LibreChat is a ChatGPT clone with additional features45CVE-2025-8848Medium· 5.4A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header42CVE-2025-8849High· 7.5LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint41
librechat vulnerabilities
CVEs affecting librechat, newest first. Open any entry for full detail, references, and exploit status.
12 CVEsRSS
CVE-2025-69222Critical· 9.1LibreChat is a ChatGPT clone with additional features
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 is prone to a server-side request forgery (SSRF) vulnerability due to missing restrictions of the Actions feature in the default configuration. LibreChat enables us…
CVE-2025-69221Medium· 4.3LibreChat is a ChatGPT clone with additional features
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. An authenticated attacker can read the permissions of arbitrary agents, even if they have no…
CVE-2025-69220High· 7.1LibreChat is a ChatGPT clone with additional features
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. An authenticated attacker with access to the agent ID can change …
CVE-2025-66452Medium· 6.1LibreChat is a ChatGPT clone with additional features
LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, there is no handler for JSON parsing errors; SyntaxError from express.json() includes user input in the error message, which gets reflected in responses.…
CVE-2025-66451Medium· 6.5LibreChat is a ChatGPT clone with additional features
LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when creating prompts, JSON requests are sent to define and modify the prompts via PATCH endpoint for prompt groups (/api/prompts/groups/:groupId). Howev…
CVE-2025-66450Medium· 5.4LibreChat is a ChatGPT clone with additional features
LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when a user posts a question, the iconURL parameter of the POST request can be modified by an attacker. The malicious code is then stored in the chat whi…
CVE-2025-66201High· 8.1LibreChat is a ChatGPT clone with additional features
LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.1-rc2, LibreChat is vulnerable to Server-side Request Forgery (SSRF), by passing specially crafted OpenAPI specs to its "Actions" feature and making the LLM use …
CVE-2025-8849High· 7.5LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint
LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint. The `key` and `value` parameters accept arbitrarily large inputs without proper validation, lead…
CVE-2025-8850High· 8.8In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow
In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA without requiring a valid OTP or backup code, bypassing the intended verifica…
CVE-2025-8848Medium· 5.4PoCA vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header
A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into t…
CVE-2025-7104High· 7.5A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions
A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by automatically binding user-provided data to internal object properties or data…
CVE-2025-7106Medium· 5.3danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks
danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The `checkAccess` function in `api/server/middleware/roles/access.js` uses `permissions.some()` to validate permissions, wh…