A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by automatically binding user-provided data to internal object properties or database fields without proper filtering. As a result, any extra fields in the request body are included in agentData and passed to the database layer, allowing overwriting of any field in the schema, such as author, access_level, isCollaborative, and projectIds. Additionally, the Object.Prototype can be polluted due to the use of Object.assign with spread operators.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 29 Sep 2025 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by automatically binding user-provided data to internal object properties or database fields without proper filtering. As a result, any extra fields in the request body are included in agentData and passed to the database layer, allowing overwriting of any field in the schema, such as author, access_level, isCollaborative, and projectIds. Additionally, the Object.Prototype can be polluted due to the use of Object.assign with spread operators. | |
| Title | Mass Assignment in danny-avila/librechat | |
| Weaknesses | CWE-915 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published:
Updated: 2025-09-29T17:10:59.630Z
Reserved: 2025-07-05T18:30:20.348Z
Link: CVE-2025-7104
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2025-09-29T17:15:32.927
Modified: 2025-09-29T19:34:10.030
Link: CVE-2025-7104
Redhat
No data.
OpenCVE Enrichment
No data.