Librechat
by Librechat
Source repositories
CVEs (52)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-11173 | Med | 0.00 | 6.5 | 0.01 | Mar 20, 2025 | An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial of service. This issue occurs when certain API endpoints receive malformed input, resulting in an uncaught exception. Although a valid JWT… | ||
| CVE-2024-11172 | Hig | 0.00 | 7.5 | 0.01 | Mar 20, 2025 | A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. The middleware `checkBan` is not surrounded by a try-catch block, and an unhandled exception will cause the… | ||
| CVE-2024-11171 | Hig | 0.00 | 7.5 | 0.01 | Mar 20, 2025 | In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipart file uploads. When using in-memory storage (the default setting for multer), there is no limit on the upload file… | ||
| CVE-2024-11170 | Hig | 0.00 | 8.8 | 0.02 | Mar 20, 2025 | A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6. | ||
| CVE-2024-11169 | Hig | 0.00 | 7.5 | 0.01 | Mar 20, 2025 | An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an exception while handling file uploads. An unauthenticated user can trigger this exception by sending a specially crafted request, causing the… | ||
| CVE-2024-11167 | Med | 0.00 | 5.3 | 0.01 | Mar 20, 2025 | An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the… | ||
| CVE-2024-10366 | Med | 0.00 | 6.5 | 0.00 | Mar 20, 2025 | An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete… | ||
| CVE-2024-10363 | Med | 0.00 | 5.4 | 0.00 | Mar 20, 2025 | In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions. | ||
| CVE-2024-10361 | Cri | 0.00 | 9.1 | 0.01 | Mar 20, 2025 | An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server.… | ||
| CVE-2024-10359 | Med | 0.00 | 4.6 | 0.00 | Mar 20, 2025 | In danny-avila/librechat version v0.7.5-rc2, a vulnerability exists in the preset creation functionality where a user can manipulate the user ID field through mass assignment. This allows an attacker to inject a different user ID into the preset object, causing the preset to… | ||
| CVE-2024-41704 | Cri | 0.00 | 9.8 | 0.01 | Jul 22, 2024 | LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images. | ||
| CVE-2024-41703 | Cri | 0.00 | 9.8 | 0.00 | Jul 22, 2024 | LibreChat through 0.7.4-rc1 has incorrect access control for message updates. |
- risk 0.00cvss 6.5epss 0.01
An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial of service. This issue occurs when certain API endpoints receive malformed input, resulting in an uncaught exception. Although a valid JWT…
- risk 0.00cvss 7.5epss 0.01
A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. The middleware `checkBan` is not surrounded by a try-catch block, and an unhandled exception will cause the…
- risk 0.00cvss 7.5epss 0.01
In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipart file uploads. When using in-memory storage (the default setting for multer), there is no limit on the upload file…
- risk 0.00cvss 8.8epss 0.02
A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6.
- risk 0.00cvss 7.5epss 0.01
An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an exception while handling file uploads. An unauthenticated user can trigger this exception by sending a specially crafted request, causing the…
- risk 0.00cvss 5.3epss 0.01
An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the…
- risk 0.00cvss 6.5epss 0.00
An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete…
- risk 0.00cvss 5.4epss 0.00
In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions.
- risk 0.00cvss 9.1epss 0.01
An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server.…
- risk 0.00cvss 4.6epss 0.00
In danny-avila/librechat version v0.7.5-rc2, a vulnerability exists in the preset creation functionality where a user can manipulate the user ID field through mass assignment. This allows an attacker to inject a different user ID into the preset object, causing the preset to…
- risk 0.00cvss 9.8epss 0.01
LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images.
- risk 0.00cvss 9.8epss 0.00
LibreChat through 0.7.4-rc1 has incorrect access control for message updates.
Page 3 of 3