LibreChat Vulnerability

LibreChat is a ChatGPT clone with additional features. It's an open-source chatbot software used by some organizations for employee management and customer support. The vulnerability allows attackers to modify prompts in a way that was not intended, potentially exposing sensitive information or granting unauthorized access to the system.

You're affected if you use LibreChat. Affected versions: 0.8.0 If you don't recognise this software, you're probably not affected.

To fix this vulnerability, upgrade to LibreChat version 0.8.1 or later. Alternatively, consider the following immediate mitigations:

• Restrict network access to your LibreChat instance (firewall it from the public internet)
• Audit admin account activity for suspicious access patterns
• Monitor for unauthorized token creation

You can find the patched version on GitHub: https://github.com/danny-avila/LibreChat/commit/01413eea3d3c1454d32ca9704fa9640407839737

• Patch
• Vendor Advisory