librechat CVE Vulnerabilities & Metrics

Focus on librechat vulnerabilities and metrics.

Last updated: 01 Aug 2025, 22:25 UTC

About librechat Security Exposure

This page consolidates all known Common Vulnerabilities and Exposures (CVEs) associated with librechat. We track both calendar-based metrics (using fixed periods) and rolling metrics (using gliding windows) to give you a comprehensive view of security trends and risk evolution. Use these insights to assess risk and plan your patching strategy.

For a broader perspective on cybersecurity threats, explore the comprehensive list of CVEs by vendor and product. Stay updated on critical vulnerabilities affecting major software and hardware providers.

Global CVE Overview

Total librechat CVEs: 13
Earliest CVE date: 22 Jul 2024, 05:15 UTC
Latest CVE date: 20 Mar 2025, 10:15 UTC

Latest CVE reference: CVE-2024-12580

Rolling Stats

30-day Count (Rolling): 0
365-day Count (Rolling): 11

Calendar-based Variation

Calendar-based Variation compares a fixed calendar period (e.g., this month versus the same month last year), while Rolling Growth Rate uses a continuous window (e.g., last 30 days versus the previous 30 days) to capture trends independent of calendar boundaries.

Variations & Growth

Month Variation (Calendar): 0%
Year Variation (Calendar): 450.0%

Month Growth Rate (30-day Rolling): 0.0%
Year Growth Rate (365-day Rolling): 450.0%

Monthly CVE Trends (current vs previous Year)

Annual CVE Trends (Last 20 Years)

Critical librechat CVEs (CVSS ≥ 9) Over 20 Years

CVSS Stats

Average CVSS: 0.0

Max CVSS: 0

Critical CVEs (≥9): 0

CVSS Range vs. Count

Range Count
0.0-3.9 13
4.0-6.9 0
7.0-8.9 0
9.0-10.0 0

CVSS Distribution Chart

Top 5 Highest CVSS librechat CVEs

These are the five CVEs with the highest CVSS scores for librechat, sorted by severity first and recency.

All CVEs for librechat

CVE-2024-12580 librechat vulnerability CVSS: 0 20 Mar 2025, 10:15 UTC

A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and file_id in the /code/download/:sessionId/:fileId and /download/:userId/:file_id APIs are not validated or filtered, leading to potential log injection attacks. This can cause distortion of monitoring and investigation information, evade detection from security systems, and create difficulties in maintenance and operation.

CVE-2024-11173 librechat vulnerability CVSS: 0 20 Mar 2025, 10:15 UTC

An unhandled exception in the danny-avila/librechat repository, version git 600d217, can cause the server to crash, leading to a full denial of service. This issue occurs when certain API endpoints receive malformed input, resulting in an uncaught exception. Although a valid JWT is required to exploit this vulnerability, LibreChat allows open registration, enabling unauthenticated attackers to create an account and perform the attack. The issue is fixed in version 0.7.6.

CVE-2024-11172 librechat vulnerability CVSS: 0 20 Mar 2025, 10:15 UTC

A vulnerability in danny-avila/librechat version git a1647d7 allows an unauthenticated attacker to cause a denial of service by sending a crafted payload to the server. The middleware `checkBan` is not surrounded by a try-catch block, and an unhandled exception will cause the server to crash. This issue is fixed in version 0.7.6.

CVE-2024-11171 librechat vulnerability CVSS: 0 20 Mar 2025, 10:15 UTC

In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipart file uploads. When using in-memory storage (the default setting for multer), there is no limit on the upload file size. This can lead to a server crash due to out-of-memory errors when handling large files. An attacker without any privileges can exploit this vulnerability to cause a complete denial of service. The issue is fixed in version 0.7.6.

CVE-2024-11170 librechat vulnerability CVSS: 0 20 Mar 2025, 10:15 UTC

A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6.

CVE-2024-11169 librechat vulnerability CVSS: 0 20 Mar 2025, 10:15 UTC

An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an exception while handling file uploads. An unauthenticated user can trigger this exception by sending a specially crafted request, causing the server to crash. The vulnerability is fixed in version 0.7.6.

CVE-2024-11167 librechat vulnerability CVSS: 0 20 Mar 2025, 10:15 UTC

An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because the endpoint does not verify whether the provided prompt ID belongs to the current user.

CVE-2024-10366 librechat vulnerability CVSS: 0 20 Mar 2025, 10:15 UTC

An improper access control vulnerability (IDOR) exists in the delete attachments functionality of danny-avila/librechat version v0.7.5-rc2. The endpoint does not verify whether the provided attachment ID belongs to the current user, allowing any authenticated user to delete attachments of other users.

CVE-2024-10363 librechat vulnerability CVSS: 0 20 Mar 2025, 10:15 UTC

In version 0.7.5 of danny-avila/LibreChat, there is an improper access control vulnerability. Users can share, use, and create prompts without being granted permission by the admin. This can break application logic and permissions, allowing unauthorized actions.

CVE-2024-10361 librechat vulnerability CVSS: 0 20 Mar 2025, 10:15 UTC

An arbitrary file deletion vulnerability exists in danny-avila/librechat version v0.7.5-rc2, specifically within the /api/files endpoint. This vulnerability arises from improper input validation, allowing path traversal techniques to delete arbitrary files on the server. Attackers can exploit this to bypass security mechanisms and delete files outside the intended directory, including critical system files, user data, or application resources. This vulnerability impacts the integrity and availability of the system.

CVE-2024-10359 librechat vulnerability CVSS: 0 20 Mar 2025, 10:15 UTC

In danny-avila/librechat version v0.7.5-rc2, a vulnerability exists in the preset creation functionality where a user can manipulate the user ID field through mass assignment. This allows an attacker to inject a different user ID into the preset object, causing the preset to appear in the UI of another user. The vulnerability arises because the backend saves the entire object received without validating the attributes and their values, impacting both integrity and confidentiality.

CVE-2024-41704 librechat vulnerability CVSS: 0 22 Jul 2024, 05:15 UTC

LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images.

CVE-2024-41703 librechat vulnerability CVSS: 0 22 Jul 2024, 05:15 UTC

LibreChat through 0.7.4-rc1 has incorrect access control for message updates.