CVE-2025-8848: Librechat XSS Vulnerability via Header Injection

CVE-2025-8848 Overview

CVE-2025-8848 is an HTML injection vulnerability in danny-avila/librechat version 0.7.9. An authenticated attacker can inject arbitrary HTML into the <html lang=""> tag of server responses by sending a crafted Accept-Language header in an HTTP GET request. The application reflects the header value into the rendered HTML without proper sanitization. This flaw creates a foundation for cross-site scripting (XSS) attacks against other users of the platform.

Critical Impact
Authenticated users can inject arbitrary HTML into server responses, enabling potential cross-site scripting (XSS) attacks that may lead to session theft, credential harvesting, or content spoofing.

Affected Products

LibreChat 0.7.9
Deployments using the affected librechat:librechat component
Self-hosted LibreChat instances exposed to authenticated users

Discovery Timeline

2025-10-22 - CVE-2025-8848 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-8848

Vulnerability Analysis

The vulnerability resides in how LibreChat processes the Accept-Language HTTP header when rendering the base HTML template. The server takes the header value and injects it directly into the lang attribute of the root <html> element. Because the application does not sanitize or encode the untrusted input, an attacker can break out of the attribute context and inject arbitrary HTML markup.

The CWE mappings clarify the dual nature of the flaw. [CWE-79] identifies the improper neutralization of input during web page generation, while [CWE-94] reflects the broader improper control of generated code. Together they describe a reflected injection point that renders in the victim's browser under the LibreChat origin.

Exploitation requires an authenticated session and user interaction to trigger the malicious request, which constrains the practical attack surface. However, a successful exploit runs in the authenticated context of the LibreChat application and can access sensitive data exposed to the DOM.

Root Cause

The root cause is missing output encoding on the Accept-Language request header before it is embedded into an HTML attribute. Template rendering treats the header as trusted locale data rather than untrusted user input. Attribute-context encoding of characters such as ", <, and > would prevent breakout from the lang attribute.

Attack Vector

The attack requires network access, low privileges (an authenticated LibreChat account), and user interaction. An attacker crafts a request with a malicious Accept-Language header value that closes the lang attribute and appends attacker-controlled HTML. When the victim's browser renders the response, the injected markup executes within the LibreChat origin. See the Huntr Bounty Listing for reproduction details.

Detection Methods for CVE-2025-8848

Indicators of Compromise

HTTP requests with unusually long Accept-Language header values containing characters such as ", <, >, or script
Server response bodies where the <html lang="..."> tag contains unexpected markup or JavaScript
Web server access logs showing authenticated GET requests followed by outbound connections to attacker-controlled domains

Detection Strategies

Inspect reverse proxy or WAF logs for Accept-Language headers that deviate from the RFC 5646 language tag format
Deploy content security policy (CSP) violation reporting to surface injected inline scripts and unauthorized script sources
Correlate authenticated LibreChat sessions with anomalous outbound requests from user browsers

Monitoring Recommendations

Enable structured logging of HTTP request headers on the LibreChat frontend and forward to a centralized analytics platform
Alert on response payloads containing header echoes with HTML metacharacters in attribute positions
Monitor authentication and session activity for signs of hijacking following user interaction with crafted URLs

How to Mitigate CVE-2025-8848

Immediate Actions Required

Upgrade LibreChat beyond version 0.7.9 once a fixed release is available from the maintainer
Deploy a web application firewall (WAF) rule to reject Accept-Language headers containing HTML metacharacters
Enforce a strict Content Security Policy that blocks inline scripts and unauthorized script sources

Patch Information

At the time of publication, no vendor advisory URL is listed in the NVD entry. Track the Huntr Bounty Listing and the upstream danny-avila/librechat repository for a patched release. Apply the fixed version to all self-hosted instances once available.

Workarounds

Configure reverse proxies such as nginx or Caddy to validate Accept-Language values against the RFC 5646 grammar and drop malformed requests
Restrict LibreChat access to trusted user populations using SSO and network segmentation until a patch is available
Apply strict CSP headers including default-src 'self' and script-src 'self' to constrain the impact of any successful HTML injection

bash

# Example nginx rule to reject Accept-Language headers containing HTML metacharacters
if ($http_accept_language ~* "[<>\"']") {
    return 400;
}