LibreChatPublished 20 Mar 2025NVD status: Analyzed

CVE-2024-12580

A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection.

ComponentLibreChat
Severitymedium (CVSS 5.3)
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Published (NVD)2025-03-20
Last modified2026-06-17
Affected versions
< 0.7.6
from the CVE Program record written by the CNA that assigned the CVE
Fixed in0.7.6
WeaknessCWE-117
CISA KEVnot listed

NVD description

A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and file_id in the /code/download/:sessionId/:fileId and /download/:userId/:file_id APIs are not validated or filtered, leading to potential log injection attacks. This can cause distortion of monitoring and investigation information, evade detection from security systems, and create difficulties in maintenance and operation.

What to do

  • Upgrade LibreChat to 0.7.6 or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources