HTML Injection Vulnerability in LibreChat by Danny Avila

CVE-2025-8848

What is CVE-2025-8848?

A vulnerability within the LibreChat application, specifically in version 0.7.9, allows for HTML injection through the Accept-Language header. When an authenticated user sends an HTTP GET request with a specially crafted Accept-Language header, it can lead to the inclusion of arbitrary HTML in the response's tag. This vulnerability may expose the application to security threats, including potential cross-site scripting (XSS) exploits, which can compromise user data and application integrity.

References