CVE-2025-8848

    Dashboard / Vulnerabilities / CVE-2025-8848

    CVE-2025-8848

    Published: 22 Oct 2025Last Modified: 10 Oct 2026

    Summary: HTML Injection in Accept-Language Header in danny-avila/librechat

    Details: A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the <html lang=""> tag of the response. This can lead to potential security risks such as cross-site scripting (XSS) attacks.

    References: https://huntr.com/bounties/a05ebc1f-882a-4adc-b178-d3cefa4b730e, https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8848.json, https://nvd.nist.gov/vuln/detail/CVE-2025-8848

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- bef5c26bed4e5053bdf1936d6ded2c77035c6ee5
    Fixed -None

    Affected versions

    0.7.9-NA

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2025-8848 | CVE-DB