LibreChat RAG API version 0.7.0 includes a log‑injection flaw that lets an attacker insert malformed data into log files, creating forged entries that could hide malicious activity or mislead forensics. This ultimately compromises the integrity of audit logs, allowing deception and obfuscation of real events. The weakness is a classic injection vulnerability, as it fails to sanitize user‑supplied input before logging it.

Systems running LibreChat RAG API 0.7.0 are affected. The vulnerability is specific to this version of the RAG API, so any deployment using this exact release or earlier without the fix is potentially susceptible.

The CVSS base score of 7.5 indicates a high impact risk. EPSS is below 1%, suggesting the probability of exploitation is currently low, and the issue is not yet in CISA’s KEV catalog. The likely attack vector would be through remote API calls that submit data to the service, given that the vulnerability is triggered via log input. However, this inference comes from the nature of the flaw rather than explicit documentation. If exploited, attackers could tamper with audit trails, undermining incident response.