CVE-2024-12580 json
Logs Debug Injection in danny-avila/librechat
published 2025-03-20 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-7005
- cvss
- 4.3
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 43%
- public exploits
- 0
- none known
Summary
A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and file_id in the /code/download/:sessionId/:fileId and /download/:userId/:file_id APIs are not validated or filtered, leading to potential log injection attacks. This can cause distortion of monitoring and investigation information, evade detection from security systems, and create difficulties in maintenance and operation.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- huntr.com https://huntr.com/bounties/6e477667-dcd4-42c2-b342-a6ce09ffdeeb referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 4.3 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected products
- danny-avila danny-avila/librechat
Classification
- Weakness
-
- CWE-117 Improper Output Neutralization for Logs
References
-
github.com
/danny-avila/librechat/commit/95d6bd2c2db4a09b308be2b96e3d5fd522c7b72a
patch
-
huntr.com
/bounties/6e477667-dcd4-42c2-b342-a6ce09ffdeeb
exploit, third-party-advisory
Sources
- CVE List CVE-2024-12580
- NVD CVE-2024-12580
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.