CVE-2024-12580 - CVE House
Back to Database
Status published Medium CVE-2024-12580

Logs Debug Injection in danny-avila/librechat

Vulnerability Description

A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and file_id in the /code/download/:sessionId/:fileId and /download/:userId/:file_id APIs are not validated or filtered, leading to potential log injection attacks. This can cause distortion of monitoring and investigation information, evade detection from security systems, and create difficulties in maintenance and operation.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-12580

Credits & Attribution

No credits recorded in the NVD database.

References

More from danny-avila

View All →
CVE-2025-8850
Insecure API Design in danny-avila/librechat
Low 3.1
CVE-2025-8849
Denial of Service in danny-avila/librechat
Medium 5.4
CVE-2025-8848
HTML Injection in Accept-Language Header in danny-avila/librechat
Medium 4.8
CVE-2025-7106
Authorization Bypass due to Incorrect Access Control in danny-avila/librechat
Medium 5.3
CVE-2025-7105
Denial of Service via JavaScript Memory Overflow in danny-avila/librechat
Medium 5.7

Affected Vendor

danny-avila

View all reports →

Affected Software

danny-avila/librechat
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: March 20th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-117

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.