CVE-2025-7104

A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by automatically binding user-provided data to internal object properties or database fields without proper filtering. As a result, any extra fields in the request body are included in agentData and passed to the database layer, allowing overwriting of any field in the schema, such as author, access_level, isCollaborative, and projectIds. Additionally, the Object.Prototype can be polluted due to the use of Object.assign with spread operators.

• CWE-915

• https://github.com/danny-avila/librechat/commit/a37bf6719cfbc2de270f7d87b6b85d87cc1768dbPatch
• https://huntr.com/bounties/32a175c4-7543-4503-a3d0-7880abd1826bExploit, Patch, Third Party Advisory

Published

Sep 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-71024Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack…7.5
• CVE-2025-71025Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack…7.5
• CVE-2025-71026Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack…7.5
• CVE-2025-71027Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack…7.5
• CVE-2025-7103A vulnerability was found in BoyunCMS up to 1.4.20. It has b…7.5
• CVE-2025-71031Water-Melon Melon commit 9df9292 and below is vulnerable to …7.5
• CVE-2025-7105A vulnerability in danny-avila/librechat allows attackers to…5.7
• CVE-2025-71056Improper session management in GCOM EPON 1GE ONU version C00…8.1
• CVE-2025-71057Improper session management in D-Link Wireless N 300 ADSL2+ …8.2
• CVE-2025-71058Dual DHCP DNS Server 8.01 improperly accepts and caches UDP …9.1
• CVE-2025-7106danny-avila/librechat is affected by an authorization bypass…5.3
• CVE-2025-71063Errands before 46.2.10 does not verify TLS certificates for …7.5