PT-2026-2183 · Librechat · Librechat

Retpoline · Published 2026-01-10 · Updated 2026-01-12 · CVE-2026-22252

Positive Technologies · (AI Summary)

CVSS v3.1

9.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibreChat versions prior to 0.8.2-rc2

Description LibreChat’s MCP stdio transport does not validate commands, allowing authenticated users to execute shell commands as root inside the container through a single API request. The vulnerable component is the MCP stdio transport. The API endpoint used for exploitation is not specified. The variable

command

is likely involved in the execution of arbitrary shell commands.

Recommendations Update to version 0.8.2-rc2 or later.

Fix

RCE

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2026-22252

Affected Products

Librechat

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-22252 · Security Note
• https://github.com/danny-avila/LibreChat/security/advisories/GHSA-cxhj-j78r-p88f · Note
• https://github.com/danny-avila/LibreChat/commit/211b39f3113d4e6ecab84be0a83f4e9c9dea127f · Note
• https://twitter.com/CVEnew/status/2010780448390004939 · Twitter Post
• https://twitter.com/0dayPublishing/status/2010780321365606826 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2010829856481694129 · Twitter Post
• https://twitter.com/TheHackerWire/status/2010804062237966389 · Twitter Post
• https://twitter.com/CveFindCom/status/2010798744879382598 · Twitter Post
• https://twitter.com/dwordj/status/2010136846567911663 · Twitter Post