What’s Vulnerable › Vulnerabilities
CVE-2025-8848: HTML Injection in Accept-Language Header in danny-avila/librechat
- Severity: medium (CVSS 5.4 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-10-22 · updated 2026-10-08
- Weakness: CWE-94
Description
A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the <html lang=""> tag of the response. This can lead to potential security risks such as cross-site scripting (XSS) attacks.
Affected products
- danny-avila LibreChat: 0.7.9
References
Get alerted when CVE-2025-8848 or the next vulnerability affects your stack