LibreChat
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 52 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from July 22, 2024 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →LibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limits
LibreChat: Stored XSS via unescaped image alt text in markdown artifact preview
LibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorization
LibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filter
LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs
LibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/fork
LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow
LibreChat: 2FA Backup Code Regeneration Without OTP Verification Allows 2FA Bypass
LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification
LibreChat: Shared-agent editor can globally delete owner's file records — breaks owner's other private agents
Monitor LibreChat in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.