CVE-2024-12580

A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and file_id in the /code/download/:sessionId/:fileId and /download/:userId/:file_id APIs are not validated or filtered, leading to potential log injection attacks. This can cause distortion of monitoring and investigation information, evade detection from security systems, and create difficulties in maintenance and operation.

• CWE-117

• https://github.com/danny-avila/librechat/commit/95d6bd2c2db4a09b308be2b96e3d5fd522c7b72aPatch
• https://huntr.com/bounties/6e477667-dcd4-42c2-b342-a6ce09ffdeebExploit, Third Party Advisory

Published

Mar 20, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12575The Poll Maker – Versus Polls, Anonymous Polls, Image Polls …5.3
• CVE-2024-12576Software installed and run as a non-privileged user may cond…5.5
• CVE-2024-12577Kernel software installed and running inside a Guest VM may …7.3
• CVE-2024-12578The Tickera – WordPress Event Ticketing plugin for WordPress…5.3
• CVE-2024-12579The Minify HTML plugin for WordPress is vulnerable to Regula…5.3
• CVE-2024-1258A vulnerability was found in Juanpao JPShop up to 1.5.02. It…5.9
• CVE-2024-12581The Gutenberg Blocks with AI by Kadence WP – Page Builder Fe…4.8
• CVE-2024-12582A flaw was found in the skupper console, a read-only interf…7.1
• CVE-2024-12583The Dynamics 365 Integration plugin for WordPress is vulnera…9.9
• CVE-2024-12584The 140+ Widgets | Xpro Addons For Elementor – FREE plugin f…6.5
• CVE-2024-12585The Property Hive WordPress plugin before 2.1.1 does not san…6.1
• CVE-2024-12586The Chalet-Montagne.com Tools WordPress plugin through 2.7.8…6.1