Back to Database
Status published
Medium
CVE-2025-8848
HTML Injection in Accept-Language Header in danny-avila/librechat
Vulnerability Description
A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the <html lang=""> tag of the response. This can lead to potential security risks such as cross-site scripting (XSS) attacks.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-8848
Credits & Attribution
No credits recorded in the NVD database.
More from danny-avila
View All →CVE-2025-8850
Insecure API Design in danny-avila/librechat
Low
3.1
CVE-2025-8849
Denial of Service in danny-avila/librechat
Medium
5.4
CVE-2025-7106
Authorization Bypass due to Incorrect Access Control in danny-avila/librechat
Medium
5.3
CVE-2025-7105
Denial of Service via JavaScript Memory Overflow in danny-avila/librechat
Medium
5.7
CVE-2025-7104
Mass Assignment in danny-avila/librechat
Medium
4.3
Affected Vendor
danny-avila
View all reports →Affected Software
danny-avila/librechat
Vulnerable Versions:
unspecified
Timeline
Official Publish:
October 22nd, 2025
Last Modified:
October 30th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N