CVE-2025-7104: Librechat: güvenlik açığı

Açıklama (NVD)

A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by automatically binding user-provided data to internal object properties or database fields without proper filtering. As a result, any extra fields in the request body are included in agentData and passed to the database layer, allowing overwriting of any field in the schema, such as author, access_level, isCollaborative, and projectIds. Additionally, the Object.Prototype can be polluted due to the use of Object.assign with spread operators.

Özet bilgiler

Ürün

Librechat Librechat

CVSS v3.1

7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

%0,30 (yüzdelik 23)

CWE

CWE-915

Yama

Mevcut

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• github.com
• huntr.com
• CWE-915