{"data":{"id":"fa8120c5-ed4f-4f4b-b451-6b0eea2fe15e","title":"CVE-2026-54025: LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, there is a…","summary":"LibreChat versions before 0.8.4-rc1 are affected by a flaw in the markdown artifact preview pipeline. When the custom image renderer in generateMarkdownHtml (client/src/utils/markdown.ts) falls back to marked v15.0.12's built-in renderer, double-quote characters in image alt text are not HTML-escaped. An attacker can craft alt text that breaks out of the alt attribute and injects an event handler, which runs in the victim's browser when the HTML is assigned to innerHTML in the Sandpack preview iframe.","solution":"Fixed in 0.8.4-rc1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54025","publishedAt":"2026-06-25T17:16:40.277Z","cveId":"CVE-2026-54025","cweIds":["CWE-79"],"cvssScore":"5.4","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["LibreChat","marked"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"low","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00239,"epssCheckedAt":"2026-11-10T12:15:57.778Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-10T00:11:44.708Z","patchAvailable":null,"disclosureDate":"2026-06-25T17:16:40.277Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":["CAPEC-198","CAPEC-86"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}