Danny-avila vulnerabilities
48 CVEs and advisories name Danny-avila as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-54024LibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limits
- CVE-2026-54025LibreChat: Stored XSS via unescaped image alt text in markdown artifact preview
- CVE-2026-54027LibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorization
- CVE-2026-54029LibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filter
- CVE-2026-54033LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs
- CVE-2026-54037LibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/fork
- CVE-2026-54030LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow
- CVE-2026-54040LibreChat: 2FA Backup Code Regeneration Without OTP Verification Allows 2FA Bypass
- CVE-2026-54036LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification
- CVE-2026-44654LibreChat: Shared-agent editor can globally delete owner's file records — breaks owner's other private agents
- CVE-2026-44653LibreChat Shared MCP Server View Leaks Decrypted Admin Secrets
- CVE-2026-32625LibreChat Exfiltrates Server Secrets via MCP Server URL Injection
- CVE-2026-31942LibreChat has IDOR in API Keys Management that allows any authenticated user to overwrite other users' API keys
- CVE-2026-34371LibreChat Affected by Arbitrary File Write via `execute_code` Artifact Filename Traversal
- CVE-2026-31951LibreChat's MCP Server Header Injection Enables OAuth Token Theft
- CVE-2026-31950LibreChat's IDOR in SSE Stream Subscription Allows Reading Other Users' Chats
- CVE-2026-31945LibreChat Server-Side Request Forgery using DNS resolution
- CVE-2026-31943LibreChat has SSRF protection bypass via IPv4-mapped IPv6 normalization in isPrivateIP
- CVE-2025-41258LibreChat RAG API Authentication Bypass
- CVE-2026-31949LibreChat Denial of Service (DoS) via Unhandled Exception in DELETE /api/convos
- CVE-2026-31944LibreChat MCP OAuth callback does not validate browser session — allows token theft via redirect link
- CVE-2025-7105Denial of Service via JavaScript Memory Overflow in danny-avila/librechat
- CVE-2026-22252LibreChat MCP Stdio Remote Command Execution
- CVE-2025-69222LibreChat is vulnerable to Server-Side Request Forgery due to missing restrictions
- CVE-2025-69221LibreChat has Insufficient Access Control for Agent Permission Queries
- CVE-2025-69220LibreChat has Insufficient Access Control for Agent Files
- CVE-2025-66452LibreChat's lack of JSON parsing error handling can lead to XSS
- CVE-2025-66451LibreChat's Improper Input Validation in Prompt Creation API Enables Unauthorized Permission Changes
- CVE-2025-66450LibreChat JSON Injection in Chat POST Allows Remote Resource Inclusion and PXSS via Image Upload
- CVE-2025-66201LibreChat is Vulnerable to Server-Side Request Forgery (SSRF) in Actions Capability