PT-2026-28429 · Librechat · Librechat

Danny-Avila · Publicado 2026-03-27 · Atualizado 2026-03-28 · CVE-2026-31943

Positive Technologies (AI Summary)

CVSS v3.1

8.5

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions LibreChat versions prior to 0.8.3

Description LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.3, the isPrivateIP() function in packages/api/src/auth/domain.ts does not correctly identify IPv4-mapped IPv6 addresses in their hex-normalized form. This allows any authenticated user to bypass Server-Side Request Forgery (SSRF) protection. Successful exploitation enables the server to make HTTP requests to internal network resources, including cloud metadata services (e.g., AWS 169.254.169.254), loopback, and RFC1918 ranges. The vulnerable function is isPrivateIP(). The affected API endpoint is not explicitly mentioned.

Recommendations Upgrade to version 0.8.3 to resolve this issue.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2026-31943

GHSA-W5R7-4F94-VP4C

Produtos afetados

Librechat

Referências · 8

• 🔥 https://github.com/danny-avila/LibreChat/security/advisories/GHSA-w5r7-4f94-vp4c · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31943.json · Exploit
• https://twitter.com/CVEnew/status/2037719424149667854 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-31943 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2037635855096144223 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2037650891487268917 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2037631437428449669 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-31943 · Aviso do Fabricante