LibreChat's MCP stdio transport, prior to version 0.8.2-rc2, treats incoming requests as direct shell commands without validation. An authenticated user can send a specially crafted API request that results in arbitrary command execution with root privileges inside the container. This flaw is a Command Injection type vulnerability (CWE-285) that can compromise confidentiality, integrity, and availability of the host system.

The affected product is LibreChat by danny-avila, specifically versions up to and including 0.8.2-rc1. The vulnerability exists in the containerized deployment of LibreChat and is resolved in 0.8.2-rc2. All users running the unpatched release that expose the MCP stdio transport are vulnerable.

The CVSS score of 9.1 indicates a critical severity, while the EPSS score of less than 1% signals a very low likelihood of exploitation observed so far, and the vulnerability is not currently listed in CISA's known exploited vulnerabilities catalog. Nevertheless, because the vulnerability allows root‑level execution from an authenticated session, it is likely to be abused once discovered. An attacker can achieve full control over the container host by sending a single API request as any legitimate user.