CVE-2025-7104: danny-avila/librechat · Mass Assignment
Affects danny-avila/librechatSource CVE Database V5
Not known to be exploited · CVSS 4.3 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 22% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 29 Sep 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| danny-avila danny-avila/librechat | Affected
| Fixed in– |
AI-suggested
To mitigate this vulnerability, organizations should implement strict server-side input validation and enforce a whitelist of allowed fields that can be modified via user input, rejecting any unexpected or extra fields in request bodies. Developers should avoid using Object.assign with spread operators on untrusted input to prevent prototype pollution; instead, use safer object merging techniques or libraries designed to handle this securely. Applying patches or updates from the vendor once available is critical. In the interim, code audits should be conducted to identify and refactor unsafe object property assignments. Employing runtime application self-protection (RASP) or web application firewalls (WAF) with custom rules to detect and block suspicious payloads targeting mass assignment or prototype pollution patterns can provide additional defense. User education to recognize phishing attempts can reduce the likelihood of successful exploitation requiring user interaction. Finally, monitoring logs for anomalous changes to sensitive fields and implementing strict access controls on database operations can help detect and limit the impact of exploitation.
Description
A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by automatically binding user-provided data to internal object properties or database fields without proper filtering. As a result, any extra fields in the request body are included in agentData and passed to the database layer, allowing overwriting of any field in the schema, such as author, access_level, isCollaborative, and projectIds. Additionally, the Object.Prototype can be polluted due to the use of Object.assign with spread operators.