CVE-2026-54025: LibreChat Markdown XSS in Artifact Preview

Technical summary

The vulnerability resides in LibreChat's markdown processing pipeline, specifically in the generateMarkdownHtml function (client/src/utils/markdown.ts). LibreChat uses the marked library (v15.0.12) for markdown-to-HTML conversion and installs a custom image renderer. When an image URL fails the isSafeUrl allowlist check, the custom renderer returns false, causing marked to fall back to its built-in image renderer. The built-in renderer does not escape double-quote characters when constructing the alt="..." attribute, allowing an attacker to break out of the attribute context with a payload like " onload="malicious_code. The resulting unsanitized HTML is then written to the DOM via innerHTML assignment within a Sandpack preview iframe, causing the injected event handler to execute with the privileges of the iframe context. The attack vector is network-based, requires low attack complexity, but mandates prior authentication and user interaction (clicking or viewing a preview).

Business impact

For organizations using LibreChat as an internal or collaborative tool, this vulnerability enables account compromise through artifact sharing. A malicious actor with authenticated access could craft a seemingly innocent artifact (such as a code snippet or document preview) containing payload in image alt text. When a colleague views that artifact, the injected script executes in their browser session, potentially allowing session hijacking, credential theft, or lateral movement. In multi-user deployments or those with high-security requirements, this represents a vector for privilege escalation or persistent compromise. The impact is limited to information disclosure and integrity violations (no availability impact), but the execution context (iframe preview) may grant access to sensitive chat histories or model interactions visible within that session.

Affected systems

LibreChat versions prior to 0.8.4-rc1 are affected. Any deployment running an earlier version—whether self-hosted, containerized, or cloud-based—is vulnerable if it allows users to create and share markdown artifacts with embedded images. The vulnerability is most impactful in team or organizational deployments where multiple users interact with shared artifacts, though single-user instances are also at risk if the user encounters malicious content from external sources.

Exploitability

Exploitation requires three conditions: (1) the attacker must be authenticated to LibreChat, (2) the victim must view or interact with a markdown artifact containing the malicious payload, and (3) the victim's browser must execute JavaScript within the Sandpack iframe context. The attack is not wormable or self-propagating. The CVSS score of 5.4 (MEDIUM) reflects the authentication requirement and user interaction barrier, which prevent widespread automated exploitation. However, in collaborative or team environments where artifact sharing is routine, user interaction is likely and the barrier to exploitation is correspondingly lower. No public exploit code or proof-of-concept is known to exist as of the publication date.

Remediation

Upgrade LibreChat to version 0.8.4-rc1 or later, which fixes the markdown artifact preview pipeline. For organizations unable to upgrade immediately, consider restricting artifact preview functionality or disabling markdown rendering of user-supplied content until a patch is deployed. Additionally, limit access to LibreChat to trusted users and monitor for suspicious artifact creation patterns. Review any artifacts shared before the patch was applied, particularly those containing images with unusual alt text.

Patch guidance

LibreChat maintainers have released version 0.8.4-rc1 as the fix. Depending on your deployment method (Docker, npm, git clone), follow the official LibreChat upgrade documentation to apply the release. For Docker users, pull the latest image tag or rebuild with the updated base. For npm-based installations, run npm update or reinstall the package. For git-based deployments, fetch the latest commit from the release branch. Verify the upgrade by checking the version string in the application settings and confirm that the markdown rendering pipeline has been updated. Test artifact preview functionality with sample images to ensure no regressions.

Detection guidance

Monitor LibreChat application logs for artifact creation or preview events, especially those involving images with unusual or suspicious alt text patterns (e.g., containing quotes, slashes, or JavaScript keywords). Check browser console logs (if accessible via developer tools) for JavaScript errors or console warnings during artifact preview rendering. Network-based detection is challenging since the payload is embedded within normal HTTP requests; however, Web Application Firewall (WAF) rules can be configured to flag suspicious image alt text in POST requests to artifact endpoints. Consider logging the raw markdown payloads before HTML conversion and scanning them for known XSS patterns. In a SOC context, correlate artifact view events with subsequent unusual API calls or lateral movement attempts.

Why prioritize this

Although the CVSS score is MEDIUM (5.4), this vulnerability should be prioritized for patching within 2–4 weeks, particularly in multi-user or team deployments. The authentication requirement and user interaction barrier reduce immediate risk compared to unauthenticated exploits, but the prevalence of artifact sharing in modern AI chat workflows makes exploitation likelihood moderate. The attack chain is straightforward and does not require sophisticated tooling. Organizations with strict data protection or compliance requirements should treat this as high priority, since the execution context could provide access to sensitive chat histories.

Risk score, explained

The CVSS v3.1 score of 5.4 reflects a network attack vector, low attack complexity, required authentication, required user interaction, and scope change (iframe context) with limited impact (confidentiality and integrity, no availability). The score would be higher if authentication were not required or if the payload could execute outside the sandboxed iframe. The inclusion in CVSS suggests a meaningful but not critical risk—suitable for prioritized patching within a standard maintenance window rather than emergency response. However, the score does not fully capture the risk in high-trust team environments where artifact sharing is common, warranting contextual elevation in risk scoring.

Frequently asked questions