agentprime: danny-avila-librechatEvery new CVE for danny-avila-librechat.https://agentprime.io/CVE-2026-54024: LibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limitshttps://agentprime.io/advisories/CVE-2026-54024/https://agentprime.io/advisories/CVE-2026-54024/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 25 Jun 2026 15:54:12 GMTCVECVE-2026-54025: LibreChat: Stored XSS via unescaped image alt text in markdown artifact previewhttps://agentprime.io/advisories/CVE-2026-54025/https://agentprime.io/advisories/CVE-2026-54025/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 25 Jun 2026 15:53:17 GMTCVECVE-2026-54027: LibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorizationhttps://agentprime.io/advisories/CVE-2026-54027/https://agentprime.io/advisories/CVE-2026-54027/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 25 Jun 2026 15:52:02 GMTCVECVE-2026-54029: LibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filterhttps://agentprime.io/advisories/CVE-2026-54029/https://agentprime.io/advisories/CVE-2026-54029/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 25 Jun 2026 15:51:23 GMTCVECVE-2026-54033: LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLshttps://agentprime.io/advisories/CVE-2026-54033/https://agentprime.io/advisories/CVE-2026-54033/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 25 Jun 2026 15:50:41 GMTCVECVE-2026-54037: LibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/forkhttps://agentprime.io/advisories/CVE-2026-54037/https://agentprime.io/advisories/CVE-2026-54037/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 25 Jun 2026 15:49:48 GMTCVECVE-2026-54030: LibreChat: Missing Resource Parameter Validation in MCP OAuth Flowhttps://agentprime.io/advisories/CVE-2026-54030/https://agentprime.io/advisories/CVE-2026-54030/CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 25 Jun 2026 15:48:00 GMTCVECVE-2026-54040: LibreChat: 2FA Backup Code Regeneration Without OTP Verification Allows 2FA Bypasshttps://agentprime.io/advisories/CVE-2026-54040/https://agentprime.io/advisories/CVE-2026-54040/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 25 Jun 2026 15:45:23 GMTCVECVE-2026-54036: LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verificationhttps://agentprime.io/advisories/CVE-2026-54036/https://agentprime.io/advisories/CVE-2026-54036/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 25 Jun 2026 15:39:33 GMTCVECVE-2026-44654: LibreChat: Shared-agent editor can globally delete owner's file records — breaks owner's other private agentshttps://agentprime.io/advisories/CVE-2026-44654/https://agentprime.io/advisories/CVE-2026-44654/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 02 Jun 2026 22:47:29 GMTCVECVE-2026-44653: LibreChat Shared MCP Server View Leaks Decrypted Admin Secretshttps://agentprime.io/advisories/CVE-2026-44653/https://agentprime.io/advisories/CVE-2026-44653/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 02 Jun 2026 22:40:20 GMTCVECVE-2026-32625: LibreChat Exfiltrates Server Secrets via MCP Server URL Injectionhttps://agentprime.io/advisories/CVE-2026-32625/https://agentprime.io/advisories/CVE-2026-32625/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 02 Jun 2026 22:35:00 GMTCVEcriticalCVE-2026-31942: LibreChat has IDOR in API Keys Management that allows any authenticated user to overwrite other users' API keyshttps://agentprime.io/advisories/CVE-2026-31942/https://agentprime.io/advisories/CVE-2026-31942/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 02 Jun 2026 22:22:13 GMTCVECVE-2026-34371: LibreChat Affected by Arbitrary File Write via `execute_code` Artifact Filename Traversalhttps://agentprime.io/advisories/CVE-2026-34371/https://agentprime.io/advisories/CVE-2026-34371/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 07 Apr 2026 21:08:13 GMTCVECVE-2026-31951: LibreChat's MCP Server Header Injection Enables OAuth Token Thefthttps://agentprime.io/advisories/CVE-2026-31951/https://agentprime.io/advisories/CVE-2026-31951/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 27 Mar 2026 19:29:25 GMTCVECVE-2026-31950: LibreChat's IDOR in SSE Stream Subscription Allows Reading Other Users' Chatshttps://agentprime.io/advisories/CVE-2026-31950/https://agentprime.io/advisories/CVE-2026-31950/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 27 Mar 2026 19:25:25 GMTCVECVE-2026-31945: LibreChat Server-Side Request Forgery using DNS resolutionhttps://agentprime.io/advisories/CVE-2026-31945/https://agentprime.io/advisories/CVE-2026-31945/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 27 Mar 2026 19:23:53 GMTCVECVE-2026-31943: LibreChat has SSRF protection bypass via IPv4-mapped IPv6 normalization in isPrivateIPhttps://agentprime.io/advisories/CVE-2026-31943/https://agentprime.io/advisories/CVE-2026-31943/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 27 Mar 2026 19:21:50 GMTCVECVE-2025-41258: LibreChat RAG API Authentication Bypasshttps://agentprime.io/advisories/CVE-2025-41258/https://agentprime.io/advisories/CVE-2025-41258/CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Mar 2026 11:08:19 GMTCVECVE-2026-31949: LibreChat Denial of Service (DoS) via Unhandled Exception in DELETE /api/convoshttps://agentprime.io/advisories/CVE-2026-31949/https://agentprime.io/advisories/CVE-2026-31949/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 13 Mar 2026 19:47:24 GMTCVECVE-2026-31944: LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect linkhttps://agentprime.io/advisories/CVE-2026-31944/https://agentprime.io/advisories/CVE-2026-31944/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 13 Mar 2026 19:44:30 GMTCVECVE-2025-7105: Denial of Service via JavaScript Memory Overflow in danny-avila/librechathttps://agentprime.io/advisories/CVE-2025-7105/https://agentprime.io/advisories/CVE-2025-7105/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Feb 2026 10:36:24 GMTCVECVE-2026-22252: LibreChat MCP Stdio Remote Command Executionhttps://agentprime.io/advisories/CVE-2026-22252/https://agentprime.io/advisories/CVE-2026-22252/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Jan 2026 18:01:48 GMTCVEcriticalCVE-2025-69222: LibreChat is vulnerable to Server-Side Request Forgery due to missing restrictionshttps://agentprime.io/advisories/CVE-2025-69222/https://agentprime.io/advisories/CVE-2025-69222/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 07 Jan 2026 21:17:17 GMTCVEcriticalCVE-2025-69221: LibreChat has Insufficient Access Control for Agent Permission Querieshttps://agentprime.io/advisories/CVE-2025-69221/https://agentprime.io/advisories/CVE-2025-69221/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 07 Jan 2026 21:01:13 GMTCVECVE-2025-69220: LibreChat has Insufficient Access Control for Agent Fileshttps://agentprime.io/advisories/CVE-2025-69220/https://agentprime.io/advisories/CVE-2025-69220/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 07 Jan 2026 20:49:00 GMTCVECVE-2025-66452: LibreChat's lack of JSON parsing error handling can lead to XSShttps://agentprime.io/advisories/CVE-2025-66452/https://agentprime.io/advisories/CVE-2025-66452/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 11 Dec 2025 22:52:20 GMTCVECVE-2025-66451: LibreChat's Improper Input Validation in Prompt Creation API Enables Unauthorized Permission Changeshttps://agentprime.io/advisories/CVE-2025-66451/https://agentprime.io/advisories/CVE-2025-66451/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 11 Dec 2025 22:33:24 GMTCVECVE-2025-66450: LibreChat JSON Injection in Chat POST Allows Remote Resource Inclusion and PXSS via Image Uploadhttps://agentprime.io/advisories/CVE-2025-66450/https://agentprime.io/advisories/CVE-2025-66450/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 11 Dec 2025 22:05:47 GMTCVECVE-2025-66201: LibreChat is Vulnerable to Server-Side Request Forgery (SSRF) in Actions Capabilityhttps://agentprime.io/advisories/CVE-2025-66201/https://agentprime.io/advisories/CVE-2025-66201/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 29 Nov 2025 01:26:18 GMTCVECVE-2025-8849: Denial of Service in danny-avila/librechathttps://agentprime.io/advisories/CVE-2025-8849/https://agentprime.io/advisories/CVE-2025-8849/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 30 Oct 2025 23:42:41 GMTCVECVE-2025-8850: Insecure API Design in danny-avila/librechathttps://agentprime.io/advisories/CVE-2025-8850/https://agentprime.io/advisories/CVE-2025-8850/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Thu, 30 Oct 2025 19:59:36 GMTCVECVE-2025-8848: HTML Injection in Accept-Language Header in danny-avila/librechathttps://agentprime.io/advisories/CVE-2025-8848/https://agentprime.io/advisories/CVE-2025-8848/CVSS 4.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Oct 2025 13:54:00 GMTCVECVE-2025-7104: Mass Assignment in danny-avila/librechathttps://agentprime.io/advisories/CVE-2025-7104/https://agentprime.io/advisories/CVE-2025-7104/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 29 Sep 2025 17:10:59 GMTCVECVE-2025-7106: Authorization Bypass due to Incorrect Access Control in danny-avila/librechathttps://agentprime.io/advisories/CVE-2025-7106/https://agentprime.io/advisories/CVE-2025-7106/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 23 Sep 2025 09:54:33 GMTCVECVE-2025-6088: Improper Authorization in danny-avila/librechathttps://agentprime.io/advisories/CVE-2025-6088/https://agentprime.io/advisories/CVE-2025-6088/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 11 Sep 2025 00:43:51 GMTCVECVE-2025-54868: LibreChat exposes arbitrary chats through Meilisearch enginehttps://agentprime.io/advisories/CVE-2025-54868/https://agentprime.io/advisories/CVE-2025-54868/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 05 Aug 2025 04:53:08 GMTCVECVE-2024-10359: Mass Assignment in Preset Creation Allows User ID Manipulation in danny-avila/librechathttps://agentprime.io/advisories/CVE-2024-10359/https://agentprime.io/advisories/CVE-2024-10359/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:10:44 GMTCVECVE-2024-11173: Unhandled Exception in danny-avila/librechathttps://agentprime.io/advisories/CVE-2024-11173/https://agentprime.io/advisories/CVE-2024-11173/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:10:33 GMTCVECVE-2024-10363: Improper Access Control in danny-avila/LibreChathttps://agentprime.io/advisories/CVE-2024-10363/https://agentprime.io/advisories/CVE-2024-10363/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:10:19 GMTCVECVE-2024-11171: Improper Input Validation in danny-avila/librechathttps://agentprime.io/advisories/CVE-2024-11171/https://agentprime.io/advisories/CVE-2024-11171/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:10:18 GMTCVECVE-2024-11172: Denial of Service in danny-avila/librechathttps://agentprime.io/advisories/CVE-2024-11172/https://agentprime.io/advisories/CVE-2024-11172/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:10:06 GMTCVECVE-2024-11169: Unhandled Exception Leading to Server Crash in danny-avila/librechathttps://agentprime.io/advisories/CVE-2024-11169/https://agentprime.io/advisories/CVE-2024-11169/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:09:59 GMTCVECVE-2024-11167: Improper Access Control in danny-avila/librechathttps://agentprime.io/advisories/CVE-2024-11167/https://agentprime.io/advisories/CVE-2024-11167/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:09:49 GMTCVEcriticalCVE-2024-10366: IDOR in delete attachments in danny-avila/librechathttps://agentprime.io/advisories/CVE-2024-10366/https://agentprime.io/advisories/CVE-2024-10366/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:09:37 GMTCVECVE-2024-12580: Logs Debug Injection in danny-avila/librechathttps://agentprime.io/advisories/CVE-2024-12580/https://agentprime.io/advisories/CVE-2024-12580/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:09:16 GMTCVECVE-2024-10361: Arbitrary File Deletion via Path Traversal in danny-avila/librechathttps://agentprime.io/advisories/CVE-2024-10361/https://agentprime.io/advisories/CVE-2024-10361/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:09:09 GMTCVECVE-2024-11170: Path Traversal in danny-avila/librechathttps://agentprime.io/advisories/CVE-2024-11170/https://agentprime.io/advisories/CVE-2024-11170/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Mar 2025 10:08:59 GMTCVE