Mass Assignment Vulnerability in LibreChat by Danny Avila

CVE-2025-7104

What is CVE-2025-7104?

The mass assignment vulnerability in LibreChat permits attackers to exploit weaknesses in data binding, enabling unauthorized manipulation of sensitive fields. By automatically binding user-supplied data to internal properties or database entries without adequate validation or filtering, this flaw allows for the overwriting of essential attributes like author details, access permissions, and project identifiers. The implementation also risks Object.Prototype pollution through the use of the Object.assign method with spread operators, consequently amplifying potential attack vectors.

References