CVE-2025-8848

MEDIUMNuclei

HTML Injection in Accept-Language Header in danny-avila/librechat

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-8848 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.

Description

A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the <html lang=""> tag of the response. This can lead to potential security risks such as cross-site scripting (XSS) attacks.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 30, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

danny-avila/librechat

Browse danny-avila / danny-avila/librechat
CVE ListThrough latestaffected

Nuclei templates

1
ProjectDiscoveryMEDIUMLibreChat <= 0.7.9 - HTML Injection via Accept-Language HeaderCVSS 5.4

danny-avila/librechat 0.7.9 contains a stored XSS caused by improper sanitization of the Accept-Language header, letting logged-in users inject arbitrary HTML into the html lang= tag, exploit requires user to be logged in.

Impact

Logged-in attackers can inject arbitrary HTML leading to cross-site scripting attacks, potentially compromising user sessions or data.

Remediation

Update to the latest version where this issue is fixed.

WeaknessesCWE-79
AuthorsKazgangap
Template tagscvecve2025librechathtml-injection
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
FOFA: app="LibreChat"
https://nvd.nist.gov/vuln/detail/CVE-2025-8848 https://huntr.com/bounties/a05ebc1f-882a-4adc-b178-d3cefa4b730e https://github.com/danny-avila/LibreChat

Source: ProjectDiscovery

References

2