CVE-2025-69220
High · 7.1CVSS
7.1
EPSS
0.3%
Published
Jan 7, 2026
CISA due date
—
The record
LibreChat has Insufficient Access Control for Agent Files
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | librechat | 0 | 0.8.2-r1 |
| Chainguard | librechat-compat | 0 | 0.8.2-r1 |
| Chainguard | librechat-dev | 0 | 0.8.2-r1 |
Related vulnerabilities
- CVE-2026-27138 Certificate verification can panic when a certificate in the chain has an empty DNS name… Also affects librechat
- CVE-2026-27137 When verifying a certificate chain which contains a certificate containing multiple email… Also affects librechat
- CVE-2026-29087 @hono/node-server allows running the Hono application on Node.js. Also affects librechat
- CVE-2026-29074 SVGO, short for SVG Optimizer, is a Node.js library and command-line application for… Also affects librechat
- CVE-2026-29045 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects librechat
- CVE-2026-29085 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects librechat
- CVE-2026-29086 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects librechat
- GHSA-xpqw-6gx7-v673 SVGO DoS through entity expansion in DOCTYPE (Billion Laughs) Also affects librechat