VULNERABILITY INTELLIGENCE

CVE-2025-7104

CVSS score7.5 HIGH
EPSS probability0.30%
CISA KEVNot currently listed
Published2025-09-29
Last modified2026-10-09
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by automatically binding user-provided data to internal object properties or database fields without proper filtering. As a result, any extra fields in the request body are included in agentData and passed to the database layer, allowing overwriting of any field in the schema, such as author, access_level, isCollaborative, and projectIds. Additionally, the Object.Prototype can be polluted due to the use of Object.assign with spread operators.

Weakness classification

  • security@huntr.dev: CWE-915

Primary references