VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Mar 20, 2025· Updated Jun 17, 2026

CVE-2024-12580

CVE-2024-12580

Description

A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and file_id in the /code/download/:sessionId/:fileId and /download/:userId/:file_id APIs are not validated or filtered, leading to potential log injection attacks. This can cause distortion of monitoring and investigation information, evade detection from security systems, and create difficulties in maintenance and operation.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Librechat/Librechat2 versions
    cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:*range: <0.7.6
    • (no CPE)range: <0.7.6
  • danny-avila/danny-avila/librechatv5
    Range: unspecified

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.