What is CVE-2024-12580?

CVE-2024-12580 is a medium-severity vulnerability in Danny-Avila Danny-Avila/librechat, classified under Improper Output Neutralization for Logs. CVSS score: 5.3/10. Published 2025-03-20.

How severe is CVE-2024-12580?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Danny-Avila Danny-Avila/librechat

CVE-2024-12580

A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and file_id in the /code/download/:sessionId/:fileId and /download/:userId/:file_id APIs are not validated or filtered, leading to potential log injection attacks. This can cause distortion of monitoring and investigation information, evade detection from security systems, and create difficulties in maintenance and operation.

EPSS: 0.005 (38.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Danny-avila Danny-avila/librechat — versions unspecified
Librechat

Weakness classification (CWE)

CWE-117 — Improper Output Neutralization for Logs

References

security@huntr.dev (Exploit, Third Party Advisory)
security@huntr.dev (Patch)

Frequently asked questions

What is CVE-2024-12580?: CVE-2024-12580 is a medium-severity vulnerability in Danny-Avila Danny-Avila/librechat, classified under Improper Output Neutralization for Logs. CVSS score: 5.3/10. Published 2025-03-20.
How severe is CVE-2024-12580?: Medium severity. CVSS v3 base score is 5.3 out of 10.