PT-2025-39846 · Librechat · Librechat

Published 2025-09-29 · Updated 2025-10-16 · CVE-2025-7104

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions librechat (affected versions not specified)

Description A mass assignment issue exists that allows manipulation of sensitive fields. Attackers can exploit this by automatically binding user-provided data to internal object properties or database fields without proper filtering. Extra fields in the request body are included in agentData and passed to the database layer, potentially overwriting fields like author, access level, isCollaborative, and projectIds. The use of Object.assign with spread operators can lead to Object.Prototype pollution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2025-7104

Affected Products

Librechat

References · 8

• https://github.com/danny-avila/librechat/commit/a37bf6719cfbc2de270f7d87b6b85d87cc1768db · Patch
• https://osv.dev/vulnerability/CVE-2025-7104 · Vendor Advisory
• https://huntr.com/bounties/32a175c4-7543-4503-a3d0-7880abd1826b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-7104 · Security Note
• https://twitter.com/VulmonFeeds/status/1972715847320805587 · Twitter Post
• https://twitter.com/CVEnew/status/1972717919131046259 · Twitter Post
• https://t.me/CVEtracker/33637 · Telegram Post
• https://t.me/cveNotify/139007 · Telegram Post