CVE-2026-54040 | Medium | 5.9 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/auth/2fa/backup/regenerate endpoint regenerates a… |
CVE-2026-54037 | Medium | 6.5 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2025-7105 added forkIpLimiter and forkUserLimit… |
CVE-2026-54033 | High | 7.7 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, LibreChat allows users to configure custom OpenAI-compatible AP… |
CVE-2026-54030 | High | 8.0 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.5, LibreChat's MCP OAuth implementation does not validate that the res… |
CVE-2026-54029 | Medium | 5.3 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the DELETE /api/messages/:conversationId/:messageId endpoint al… |
CVE-2026-54027 | Medium | 6.5 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/images endpoint allows any authenticated us… |
CVE-2026-54025 | Medium | 5.4 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, there is a vulnerability in LibreChat's markdown artifact previ… |
CVE-2026-54024 | Medium | 6.5 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the fix for CVE-2024-11171 (commit bb58a2d0) added limits: { fi… |
CVE-2026-54036 | Medium | 5.3 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the GET /api/auth/2fa/enable endpoint can be called by an authe… |
CVE-2026-44654 | High | 8.1 | 2026-06-02 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, a shared-agent editor can delete file record… |
CVE-2026-44653 | Medium | 6.5 | 2026-06-02 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, users with only `VIEW` access to an MCP serv… |
CVE-2026-32625 | Critical | 9.6 | 2026-06-02 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the Model Context Protocol (MCP) server inte… |
CVE-2026-31942 | High | 7.1 | 2026-06-02 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.7.6, an Insecure Direct Object Reference (IDOR) v… |
CVE-2026-34371 | Medium | 6.3 | 2026-04-07 | LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the execute_code sandbox when persisting cod… |
CVE-2026-31951 | Medium | 6.8 | 2026-03-27 | LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc1 through 0.8.3-rc1, user-created MCP (Model Context Protocol) servers can include a… |
CVE-2026-31950 | Medium | 5.3 | 2026-03-27 | LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc2 through 0.8.2-rc3, the SSE streaming endpoint `/api/agents/chat/stream/:streamId`… |
CVE-2026-31945 | High | 7.7 | 2026-03-27 | LibreChat is a ChatGPT clone with additional features. Versions 0.8.2-rc2 through 0.8.2 are vulnerable to a server-side request forgery (SSRF) attack when usin… |
CVE-2026-31943 | High | 8.5 | 2026-03-27 | LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.3, `isPrivateIP()` in `packages/api/src/auth/domain.ts` fails to detect IPv4-mapped… |
CVE-2025-41258 | High | 8.0 | 2026-03-18 | LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG A… |
CVE-2026-31949 | Medium | 6.5 | 2026-03-13 | LibreChat is a ChatGPT clone with additional features. Prior to 0.8.3-rc1, a Denial of Service (DoS) vulnerability exists in the DELETE /api/convos endpoint th… |
CVE-2026-31944 | High | 7.6 | 2026-03-13 | LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP (Model Context Protocol) OAuth callback endpoint accepts the redirect f… |
CVE-2025-7105 | Medium | 5.7 | 2026-02-02 | A vulnerability in danny-avila/librechat allows attackers to exploit the unrestricted Fork Function in `/api/convos/fork` to fork numerous contents rapidly. If… |
CVE-2026-22252 | Critical | 9.1 | 2026-01-12 | LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbitrary commands without validation, allo… |
CVE-2025-69222 | Critical | 9.1 | 2026-01-07 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 is prone to a server-side request forgery (SSRF)
vulnerability due to missing restrict… |
CVE-2025-69221 | Medium | 4.3 | 2026-01-07 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when
querying agent permissions. An authenticat… |
CVE-2025-69220 | High | 7.1 | 2026-01-07 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and… |
CVE-2025-66452 | Medium | 6.1 | 2025-12-11 | LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, there is no handler for JSON parsing errors; SyntaxError from express.json(… |
CVE-2025-66451 | Medium | 6.5 | 2025-12-11 | LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when creating prompts, JSON requests are sent to define and modify the prom… |
CVE-2025-66450 | Medium | 5.4 | 2025-12-11 | LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when a user posts a question, the iconURL parameter of the POST request can… |
CVE-2025-66201 | High | 8.1 | 2025-11-29 | LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.1-rc2, LibreChat is vulnerable to Server-side Request Forgery (SSRF), by passing sp… |
CVE-2025-8849 | High | 7.5 | 2025-10-31 | LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint. The `key` and `val… |
CVE-2025-8850 | High | 8.8 | 2025-10-30 | In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA… |
CVE-2025-8848 | Medium | 5.4 | 2025-10-22 | A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET reques… |
CVE-2025-7104 | High | 7.5 | 2025-09-29 | A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by… |
CVE-2025-7106 | Medium | 5.3 | 2025-09-23 | danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The `checkAccess` function in `api/server/mid… |
CVE-2025-6088 | Low | 3.1 | 2025-09-11 | In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conver… |
CVE-2025-54868 | High | 7.5 | 2025-08-05 | LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly… |
CVE-2024-12580 | Medium | 5.3 | 2025-03-20 | A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and file_id in the /… |
CVE-2024-11173 | Medium | 6.5 | 2025-03-20 | An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial of service. This i… |
CVE-2024-11172 | High | 7.5 | 2025-03-20 | A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to th… |
CVE-2024-11171 | High | 7.5 | 2025-03-20 | In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipar… |
CVE-2024-11170 | High | 8.8 | 2025-03-20 | A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. Thi… |
CVE-2024-11169 | High | 7.5 | 2025-03-20 | An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an exception while handl… |
CVE-2024-11167 | Medium | 5.3 | 2025-03-20 | An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the gro… |
CVE-2024-10366 | Medium | 6.5 | 2025-03-20 | An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does n… |
CVE-2024-10363 | Medium | 5.4 | 2025-03-20 | In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted pe… |
CVE-2024-10361 | Critical | 9.1 | 2025-03-20 | An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability ar… |
CVE-2024-10359 | Medium | 4.6 | 2025-03-20 | In danny-avila/librechat version v0.7.5-rc2, a vulnerability exists in the preset creation functionality where a user can manipulate the user ID field through… |