repository icon
danny-avila / librechat Project repository

Enhanced ChatGPT Clone: Features Anthropic, AWS, OpenAI, Assistants API, Azure, Groq, o1, GPT-4o, Mistral, OpenRouter, Vertex AI, Gemini, Artifacts, AI model switching, message search, langchain, DALL-E-3, ChatGPT Plugins, OpenAI Functions, Secure Multi-User System, Presets, completely open-source for self-hosting. Actively in public development.

Submit a report

FIRST INTERACTION

WITHIN14 DAYS

REVIEW

WITHIN14 DAYS

FIX

WITHIN92 DAYS

Unrestricted Access to User Information
seedmaharaj
not applicable
Unauthorized Access to Uploaded Chat Images in LibreChat
devanshbatham
informative
Medium
Lack of Login Attempt Limitation Allowing Brute-Force Attack
sebob
duplicate
Critical
Unauthorized user can make other users chats public and deny share access.
securitytaters
duplicate
High
Eleven labs TTS API Key Exposed in GitHub Repository
brotheralameen1
informative
Low
IDOR enabled attacker to delete a non-collaborative agent
brotheralameen1
not applicable
Server allows upload for concurrent images at the same time
brotheralameen1
informative
High
IDOR allows attacker to modify script prompts of the victim
brotheralameen1
duplicate
High
Access control is broken when sharing someone else's chat
trungg02
duplicate
Medium
Denial of service
oicu0619
informative
High
unhandled exception caused server crash
oicu0619
informative
High
Improper Access Control Allows deleting other users' reminders
trungg02
Critical
•$900•CVE-2024-11167
Exception unhandled, lead to server crash
oicu0619
High
•$450•CVE-2024-11169
multer(file upload middleware in express) misused, lead to remote code execution
oicu0619
High
•$450•CVE-2024-11170
Not limitation of upload file size, lead to server crash
oicu0619
High
•$450•CVE-2024-11171
IDOR allows delete arbitrary group of prompts from other users
nduy2110
duplicate
Critical
Idor in the share conversation function
trunggg02
duplicate
High
Denial of service cause by unhandled exception
oicu0619
High
•$450•CVE-2024-11172
IDOR In Conversation Sharing Feature Causes 2 Dangerous Impact
quyenheu
informative
Medium
Logs Debug Injection In File Download
quyenheu
Medium
•$75•CVE-2024-12580
unhandled exception caused server crash
oicu0619
Medium
•$75•CVE-2024-11173
Allowing execution user provided regexp, lead to Redos
oicu0619
Medium
•$75
"Broken Access Control: IP-Based Ban Bypass via Spoofed X-Forwarded-For Header"
zhallen122
duplicate
Medium
Path Traversal that leads to remove other files with node permission
jiniljeil
duplicate
High
IDOR in the delete attachments
trunggg02
High
•$450•CVE-2024-10366
User can share/use/create prompts not permission
meme-dm
Medium
•$90•CVE-2024-10363
Bypass ratelimit with X-Forwarded-For
meme-dm
duplicate
High
Broken access control user can edit prompts other user
meme-dm
self closed
stored xss
ranjit-git
spam
Mass Assignment in Preset creation allows user id manipulation
acciobugs
Medium
•$75•CVE-2024-10359
Arbitrary File Deletion
codevigilanteofficial
duplicate
Critical
Path Traversal in "assistants"
mvlttt
duplicate
Medium
Path Traversal
mvlttt
duplicate
Medium
Improper Access Control Allows deleting other users' reminders
trungg02
not applicable
Arbitrary File Deletion via Path Traversal
0x13a0f
High
•$450•CVE-2024-10361
Bypass of Rate Limiting in every endpoint
0x13a0f
informative
High
CSRF on endpoint for user signup
vn-ncvinh
self closed
idor bug to delete any file of any user
ranjit-git
not applicable
password reset link leaked in response allow to hijack anyone account
ranjit-git
informative
Critical