CVE Tools
Track your stack

Librechat

32 CVEs tracked since 2025. Since Mar 2025, none of them reached CISA KEV.

Librechat CVEs per month

Mar 2025 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Librechat CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2025-03110
2025-044 or fewer
2025-054 or fewer
2025-064 or fewer
2025-075 or fewer
2025-084 or fewer
2025-094 or fewer
2025-104 or fewer
2025-114 or fewer
2025-125 or fewer
2026-015 or fewer
2026-025 or fewer
2026-0390
2026-046 or fewer
2026-057 or fewer
2026-06120
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Librechat's monthly top three, with their CVEs summed over those months.

  1. Librechat323 months
  2. Rag API11 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Librechat.

  1. CVE-2026-54024LibreChat: Incomplete Fix for CVE-2024-11171 — Conversation Import Multer Instance Missing File Size Limits6.5
  2. CVE-2026-54025LibreChat: Stored XSS via unescaped image alt text in markdown artifact preview5.4
  3. CVE-2026-54027LibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorization6.5
  4. CVE-2026-54029LibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filter5.3
  5. CVE-2026-54033LibreChat: SSRF via User-Provided Custom Endpoint baseURL — no private IP validation on user-configured API base URLs7.7
  6. CVE-2026-54037LibreChat: Incomplete Fix for CVE-2025-7105 — /api/convos/duplicate Lacks Rate Limiting Applied to /api/convos/fork6.5
  7. CVE-2026-54030LibreChat: Missing Resource Parameter Validation in MCP OAuth Flow8.0
  8. CVE-2026-54036LibreChat: 2FA Re-enrollment Allows Full Account 2FA Takeover Without OTP Verification5.3
  9. CVE-2026-44654LibreChat: Shared-agent editor can globally delete owner's file records — breaks owner's other private agents8.1
  10. CVE-2026-44653LibreChat Shared MCP Server View Leaks Decrypted Admin Secrets6.5
  11. CVE-2026-32625LibreChat Exfiltrates Server Secrets via MCP Server URL Injection9.6
  12. CVE-2026-31942LibreChat has IDOR in API Keys Management that allows any authenticated user to overwrite other users' API keys7.1
  13. CVE-2026-34371LibreChat Affected by Arbitrary File Write via `execute_code` Artifact Filename Traversal6.3
  14. CVE-2026-31951LibreChat's MCP Server Header Injection Enables OAuth Token Theft6.8
  15. CVE-2026-31950LibreChat's IDOR in SSE Stream Subscription Allows Reading Other Users' Chats5.3

The record

Peak rank
#91 in Mar 2025
Busiest month shown
Jun 2026, 12 CVEs
Months with a KEV entry
0 since Mar 2025
Monthly snapshots
3 since 2025
Librechat's full record, month by month