Danny Avila

24 exploits Active since Mar 2025
CVE-2024-10359 WRITEUP MEDIUM WRITEUP
danny-avila/librechat <0.7.5-rc2 - Code Injection
In danny-avila/librechat version v0.7.5-rc2, a vulnerability exists in the preset creation functionality where a user can manipulate the user ID field through mass assignment. This allows an attacker to inject a different user ID into the preset object, causing the preset to appear in the UI of another user. The vulnerability arises because the backend saves the entire object received without validating the attributes and their values, impacting both integrity and confidentiality.
CVSS 4.6
CVE-2024-10361 WRITEUP CRITICAL WRITEUP
librechat v0.7.5-rc2 - Arbitrary File Deletion via Path Traversal in /api/files Endpoint
An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit this to bypass security mechanisms and delete files outside the intended directory, including critical system files, user data, or application resources. This vulnerability impacts the integrity and availability of the system.
CVSS 9.1
CVE-2024-10363 WRITEUP MEDIUM WRITEUP
LibreChat 0.7.5 - Missing Authorization for Prompt Sharing and Creation
In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions.
CVSS 5.4
CVE-2024-10366 WRITEUP MEDIUM WRITEUP
LibreChat 0.7.5-rc2 Attachments - Insecure Direct Object Reference
An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.
CVSS 6.5
CVE-2024-11167 WRITEUP MEDIUM WRITEUP
librechat < 0.7.6 - Authenticated Prompt Deletion via GroupID Parameter
An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.
CVSS 5.3
CVE-2024-11169 WRITEUP HIGH WRITEUP
danny-avila/librechat <3c94ff2 - DoS
An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an exception while handling file uploads. An unauthenticated user can trigger this exception by sending a specially crafted request, causing the server to crash. The vulnerability is fixed in version 0.7.6.
CVSS 7.5
CVE-2024-11170 WRITEUP HIGH WRITEUP
librechat < 0.7.6 - Path Traversal and Arbitrary File Write via Multer Middleware
A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6.
CVSS 8.8
CVE-2024-11171 WRITEUP HIGH WRITEUP
librechat < 0.7.6 - Unauthenticated Denial of Service via Unrestricted File Upload Size
In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipart file uploads. When using in-memory storage (the default setting for multer), there is no limit on the upload file size. This can lead to a server crash due to out-of-memory errors when handling large files. An attacker without any privileges can exploit this vulnerability to cause a complete denial of service. The issue is fixed in version 0.7.6.
CVSS 7.5
CVE-2024-11172 WRITEUP HIGH WRITEUP
librechat < 0.7.6 - Unauthenticated Denial of Service via Unhandled Exception in checkBan Middleware
A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. The middleware `checkBan` is not surrounded by a try-catch block, and an unhandled exception will cause the server to crash. This issue is fixed in version 0.7.6.
CVSS 7.5
CVE-2024-11173 WRITEUP MEDIUM WRITEUP
librechat < 0.7.6 - Denial of Service via Malformed API Input
An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial of service. This issue occurs when certain API endpoints receive malformed input, resulting in an uncaught exception. Although a valid JWT is required to exploit this vulnerability, LibreChat allows open registration, enabling unauthenticated attackers to create an account and perform the attack. The issue is fixed in version 0.7.6.
CVSS 6.5
CVE-2024-12580 WRITEUP MEDIUM WRITEUP
danny-avila/librechat <0.7.6 - Code Injection
A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and file_id in the /code/download/:sessionId/:fileId and /download/:userId/:file_id APIs are not validated or filtered, leading to potential log injection attacks. This can cause distortion of monitoring and investigation information, evade detection from security systems, and create difficulties in maintenance and operation.
CVSS 5.3
CVE-2025-54868 WRITEUP HIGH WRITEUP
LibreChat 0.0.6-0.7.7-rc1 - Unauthenticated Arbitrary Chat Data Exposure via Meilisearch Test Endpoint
LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly from the Meilisearch engine. The endpoint /api/search/test allows for direct access to stored chats in the Meilisearch engine without proper access control. This results in the ability to read chats from arbitrary users. This issue is fixed in version 0.7.7.
CVSS 7.5
CVE-2025-6088 WRITEUP LOW WRITEUP
danny-avila/librechat <0.7.8 - Info Disclosure
In version 0.7.8 of danny-avila/librechat, improper authorization controls in the conversation sharing feature allow unauthorized access to other users' conversations if the conversation ID is known. Although UUIDv4 conversation IDs are generated server-side and are difficult to brute force, they can be obtained from less-protected sources such as server-side access logs, browser history, or screenshots. The vulnerability permits a logged-in user to gain read-only access to another user's conversations by exploiting the `/api/share/conversationID` endpoint, which lacks authorization checks. This issue is resolved in version v0.7.9-rc1.
CVSS 3.1
CVE-2025-66450 WRITEUP MEDIUM WRITEUP
LibreChat < 0.8.1 - Stored Cross-Site Scripting via IconURL Parameter
LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when a user posts a question, the iconURL parameter of the POST request can be modified by an attacker. The malicious code is then stored in the chat which can then be shared to other users. When sharing chats with a potentially malicious “tracker”, resources loaded can lead to loss of privacy for users who view the chat link that is sent to them. This issue is fixed in version 0.8.1.
CVSS 5.4
CVE-2025-66451 WRITEUP MEDIUM WRITEUP
LibreChat < 0.8.1 - Improperly Controlled Modification of Dynamically-Determined Object Attributes via PATCH Endpoint
LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when creating prompts, JSON requests are sent to define and modify the prompts via PATCH endpoint for prompt groups (/api/prompts/groups/:groupId). However, the request bodies are not sufficiently validated for proper input, enabling users to modify prompts in a way that was not intended as part of the front end system. The patchPromptGroup function passes req.body directly to updatePromptGroup() without filtering sensitive fields. This issue is fixed in version 0.8.1.
CVSS 6.5
CVE-2025-69220 WRITEUP HIGH WRITEUP
LibreChat 0.8.1-rc2 - Authenticated Improper Access Control in File Upload and Search
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and file search. An authenticated attacker with access to the agent ID can change the behavior of arbitrary agents by uploading new files to the file context or file search, even if they have no permissions for this agent. This issue is fixed in version 0.8.2-rc2.
CVSS 7.1
CVE-2025-69221 WRITEUP MEDIUM WRITEUP
LibreChat 0.8.1-rc2 - Authenticated Improper Access Control via Agent Permissions Query
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. An authenticated attacker can read the permissions of arbitrary agents, even if they have no permissions for this agent. LibreChat allows the configuration of agents that have a predefined set of instructions and context. Private agents are not visible to other users. However, if an attacker knows the agent ID, they can read the permissions of the agent including the permissions individually assigned to other users. This issue is fixed in version 0.8.2-rc2.
CVSS 4.3
CVE-2025-69222 WRITEUP CRITICAL WRITEUP
LibreChat Actions - Internal Service Server-Side Request Forgery
LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 is prone to a server-side request forgery (SSRF) vulnerability due to missing restrictions of the Actions feature in the default configuration. LibreChat enables users to configure agents with predefined instructions and actions that can interact with remote services via OpenAPI specifications, supporting various HTTP methods, parameters, and authentication methods including custom headers. By default, there are no restrictions on accessible services, which means agents can also access internal components like the RAG API included in the default Docker Compose setup. This issue is fixed in version 0.8.1-rc2.
CVSS 9.1
CVE-2025-7104 WRITEUP HIGH WRITEUP
danny-avila/librechat - Mass Assignment
A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by automatically binding user-provided data to internal object properties or database fields without proper filtering. As a result, any extra fields in the request body are included in agentData and passed to the database layer, allowing overwriting of any field in the schema, such as author, access_level, isCollaborative, and projectIds. Additionally, the Object.Prototype can be polluted due to the use of Object.assign with spread operators.
CVSS 7.5
CVE-2025-7105 WRITEUP MEDIUM WRITEUP
danny-avila/librechat - Use After Free
A vulnerability in danny-avila/librechat allows attackers to exploit the unrestricted Fork Function in `/api/convos/fork` to fork numerous contents rapidly. If the forked content includes a Mermaid graph with a large number of nodes, it can lead to a JavaScript heap out of memory error upon service restart, causing a denial of service. This issue affects the latest version of the product.
CVSS 5.7
CVE-2025-7106 WRITEUP MEDIUM WRITEUP
librechat < 0.7.9 - Improper Access Control in checkAccess Function
danny-avila/librechat is affected by an authorization bypass vulnerability due to improper access control checks. The `checkAccess` function in `api/server/middleware/roles/access.js` uses `permissions.some()` to validate permissions, which incorrectly grants access if only one of multiple required permissions is present. This allows users with the 'USER' role to create agents despite having `CREATE: false` permission, as the check for `['USE', 'CREATE']` passes with just `USE: true`. This vulnerability affects other permission checks as well, such as `PROMPTS`. The issue is present in all versions prior to the fix.
CVSS 5.3
CVE-2025-8849 WRITEUP HIGH WRITEUP
LibreChat 0.7.9 - Denial of Service via Unbounded Parameters in /api/memories Endpoint
LibreChat version 0.7.9 is vulnerable to a Denial of Service (DoS) attack due to unbounded parameter values in the `/api/memories` endpoint. The `key` and `value` parameters accept arbitrarily large inputs without proper validation, leading to a null pointer error in the Rust-based backend when excessively large values are submitted. This results in the inability to create new memories, impacting the stability of the service.
CVSS 7.5
CVE-2025-8850 WRITEUP HIGH WRITEUP
danny-avila/librechat <0.7.9 - Auth Bypass
In danny-avila/librechat version 0.7.9, there is an insecure API design issue in the 2-Factor Authentication (2FA) flow. The system allows users to disable 2FA without requiring a valid OTP or backup code, bypassing the intended verification process. This vulnerability occurs because the backend does not properly validate the OTP or backup code when the API endpoint '/api/auth/2fa/disable' is directly accessed. This flaw can be exploited by authenticated users to weaken the security of their own accounts, although it does not lead to full account compromise.
CVSS 8.8
CVE-2026-22252 WRITEUP CRITICAL WRITEUP
LibreChat < 0.8.2-rc2 - Authenticated Remote Code Execution via MCP Stdio Transport
LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbitrary commands without validation, allowing any authenticated user to execute shell commands as root inside the container through a single API request. This vulnerability is fixed in v0.8.2-rc2.
CVSS 9.1