A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the <html lang=""> tag of the response. This can lead to potential security risks such as cross-site scripting (XSS) attacks.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Librechat |
|
No data.
No data.
References
History
Thu, 23 Oct 2025 10:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Librechat
Librechat librechat |
|
| Vendors & Products |
Librechat
Librechat librechat |
Wed, 22 Oct 2025 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the <html lang=""> tag of the response. This can lead to potential security risks such as cross-site scripting (XSS) attacks. | |
| Title | HTML Injection in Accept-Language Header in danny-avila/librechat | |
| Weaknesses | CWE-94 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published: 2025-10-22T13:54:00.389Z
Updated: 2025-10-22T13:54:00.389Z
Reserved: 2025-08-10T18:16:29.790Z
Link: CVE-2025-8848
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2025-10-22T14:15:52.393
Modified: 2025-10-22T21:12:48.953
Link: CVE-2025-8848
Redhat
No data.