漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Mass Assignment in danny-avila/librechat
Vulnerability Description
A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by automatically binding user-provided data to internal object properties or database fields without proper filtering. As a result, any extra fields in the request body are included in agentData and passed to the database layer, allowing overwriting of any field in the schema, such as author, access_level, isCollaborative, and projectIds. Additionally, the Object.Prototype can be polluted due to the use of Object.assign with spread operators.
CVSS Information
N/A
Vulnerability Type
CWE-915
Vulnerability Title
LibreChat 安全漏洞
Vulnerability Description
LibreChat是Danny Avila个人开发者的一个增强的 ChatGPT 克隆。 LibreChat存在安全漏洞，该漏洞源于自动绑定用户提供的数据到内部对象属性或数据库字段时未进行适当过滤，可能导致敏感字段被操纵和原型污染。
CVSS Information
N/A
Vulnerability Type
N/A