CVE-20XX-?

Librechat CVEs.

Published CVEs affecting Librechat, ranked by exploit odds.

2 CVEs · updated 2026-11-06 08:59 UTC

Reset all
  1. CVE-2026-22252

    LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbitrary commands without validation, allowing any authenticated user to execute shell commands as root inside the container through a single API request. This vulnerability is fixed in v0.8.2-rc2.

    Code execution Librechat

    9.1 CRITICAL 4% exploit odds Fix listed
  2. CVE-2024-11170

    A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6.

    Code execution Librechat

    8.8 HIGH 2% exploit odds Fix listed

All CVEs affecting Librechat that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.