Mass Assignment Vulnerability in LibreChat by Danny Avila

CVE-2025-7104

What is CVE-2025-7104?

The mass assignment vulnerability in LibreChat permits attackers to exploit weaknesses in data binding, enabling unauthorized manipulation of sensitive fields. By automatically binding user-supplied data to internal properties or database entries without adequate validation or filtering, this flaw allows for the overwriting of essential attributes like author details, access permissions, and project identifiers. The implementation also risks Object.Prototype pollution through the use of the Object.assign method with spread operators, consequently amplifying potential attack vectors.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References