CVE-2025-7104: Mass Assignment in danny-avila/librechat
A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by automatically binding user-provided data to internal object properties or database fields without proper filtering. As a result, any extra fields in the request body are included in agentData and passed to the database layer, allowing overwriting of any field in the schema, such as author, accesslevel, isCollaborative, and projectIds. Additionally, the Object.Prototype can be polluted due to the use of Object.assign with spread operators.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7104?
CVE-2025-7104 is classified as a high severity vulnerability due to its potential for mass assignment attacks.
How do I fix CVE-2025-7104?
To fix CVE-2025-7104, implement proper data filtering and validation mechanisms to restrict user input from being bound to sensitive fields.
What are the implications of CVE-2025-7104 for my application?
The implications of CVE-2025-7104 include unauthorized access and manipulation of sensitive data, which can compromise application security.
Which versions of librechat are affected by CVE-2025-7104?
All versions of danny-avila/librechat are affected by CVE-2025-7104.
Can CVE-2025-7104 lead to data breaches?
Yes, CVE-2025-7104 can lead to data breaches by allowing attackers to manipulate or access sensitive information.