CVE-2025-8848 — HTML Injection in Accept-Language Header in danny-avila/librechat

CVE-2025-8848

HTML Injection in Accept-Language Header in danny-avila/librechat PUBLISHED

Description (CNA)

A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the <html lang=""> tag of the response. This can lead to potential security risks such as cross-site scripting (XSS) attacks.

Affected (CNA)

Vendor / product	Versions
danny-avila / danny-avila/librechat	affected unspecified through latest

CWE

CWE-94

References

https://huntr.com/bounties/a05ebc1f-882a-4adc-b178-d3cefa4b730e

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.