github.com / LibreChat-AI

LibreChat-AI/LibreChat

TypeScript·7079 files·commit 8d3da9b·scanned 1d ago·cached ✓

15/100

LOW RISK

Minor findings consistent with the project type. Nothing reachable from install hooks.

score capped at 15 — 46,389+ stars — findings likely false positives

verdict accurate?

46,389 stars

42% file coverage

Partial architecture graph

threat-state: lowlive

FINDINGS ░▒▓

criticalPython dynamic code executioneval(), exec() or compile() on untrusted input can execute arbitrary code. Common in Python malware for running obfuscated payloads..github/scripts/test_main_promotion.py

POLICY = types.ModuleType('promotion_policy')
exec(compile(SOURCE, str(WORKFLOW), 'exec'), POLICY.__dict__)
DEV = 'd' * 40
MAIN = 'a' * 40

criticalchild_process / exec usageExecuting shell commands can be used to download and run malware, exfiltrate data, or modify system files.packages/api/src/agents/hooks/reaper.spec.ts

function run(command: string): ChildProcess {
  return spawn('bash', ['-c', command], {
    detached: true,
    stdio: 'ignore',

criticaleval() usage detectedeval() executes arbitrary code and is commonly used in malware to run obfuscated payloads fetched from remote servers.packages/api/src/agents/subagentTaskRouting.spec.ts


  async eval(
    _script: string,
    _keyCount: number,

infoSuspicious files are not reachable from entry pointsFlagged files exist but are not imported by any entry point. They may be dead code, tests, or attack payloads triggered by another mechanism.+2

warningExtremely long lines (>1000 chars)Very long lines in source files (not minified bundles) can hide malicious code.client/src/utils/direction.ts+4

warningLarge base64-encoded blobA 92-character base64 blob was found. May hide a remote payload or encoded executable code.api/server/routes/assistants/avatar.spec.js

iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8...

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.api/server/utils/import/fork.js+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.api/server/utils/import/importers.spec.js+3

warningFlattened or dead control flowDetected switch(true), dead if branches, or deeply nested ternaries — patterns used by obfuscators to hide execution order.client/src/utils/getLoginError.ts+3

infoSuspicious file in repoVery large source file (1615KB) — could contain obfuscated payloadpackage-lock.json+2

warningPossible typosquat: xlsx"xlsx" is only 1 character(s) away from the popular package "clsx". This is a common supply-chain attack vector.package.json+4

infoAuthor has no other public repositoriesGitHub user "lia-by-librechat[bot]" has no other public repositories, common for burner accounts used in scams.+2

warningUnvalidated file uploadFile upload without type/size validation. Can be exploited for remote code execution or storage abuse.api/package.json

    "mongoose": "^8.24.1",
    "multer": "^2.5.0",
    "nanoid": "^3.3.18",
    "node-fetch": "^2.7.0",

warningUnvalidated file uploadFile upload without type/size validation. Can be exploited for remote code execution or storage abuse.packages/api/package.json

    "@types/jsonwebtoken": "^9.0.0",
    "@types/multer": "^1.4.13",
    "@types/node": "^24.12.4",
    "@types/node-fetch": "^2.6.13",

warningUnvalidated file uploadFile upload without type/size validation. Can be exploited for remote code execution or storage abuse.api/server/routes/files/index.js

const { avatar: agentAvatarRouter } = require('~/server/routes/agents/v1');
const { createMulterInstance } = require('./multer');

const files = require('./files');

warningPotential NoSQL injectionUser input passed directly to MongoDB query (findOne, find, updateOne) without sanitization. Attacker can inject query operators.api/server/routes/share.js+4

warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.packages/api/src/agents/inference.request.spec.ts

  const { llmConfig } = getOpenAILLMConfig({
    apiKey: 'synthetic-server-key',
    streaming: true,
    endpoint: 'openAI',

warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.packages/api/src/agents/input.spec.ts

    (key) => {
      const secret = 'never-return-this-submitted-value';
      try {
        input({ temperature: 0.5, [key]: { nested: secret } });

warningHardcoded secret/credentialAPI keys, passwords, or tokens hardcoded in source code. Should be in environment variables.packages/api/src/app/loader.inference.spec.ts

          name: 'Gateway',
          apiKey: 'synthetic-server-key',
          baseURL: 'https://gateway.invalid/v1',
          models: { default: ['permitted'], fetch: false },

Scores are heuristics. A “safe” verdict means no known-malicious patterns were found — clever malware can look boring. Wrong verdict? Flag it above; confirmed false positives become regression tests.

3000 files scanned @ 8d3da9b | 10/28/2026 | heuristic scan — always review manually

risk by category

code execution25

network & exfiltration0

file system access0

obfuscation15

supply chain8

owasp / injection15

telemetry

files 3000/7079rules hit 19engine v7commit 8d3da9b

github

LibreChat-AI/LibreChat

Enhanced ChatGPT Clone: Features Agents, MCP, Skills, DeepSeek, Anthropic, AWS, OpenAI, Responses API, Azure, Groq, o1, GPT-5, Mistral, OpenRouter, Vertex AI, Gemini, Artifacts, AI model switching, message search, Code Interpreter, langchain, DALL-E-3, OpenAPI Actions, Functions, Secure Multi-User Auth, Presets, open-source for self-hosting. Active

TypeScript

46389

9529

1356d

7079 files

3000 scanned(42%)

8d3da9b

architecture░▒▓

entry (7) flagged (19) pkg (191)

591 nodes · 1050 edgesscroll to zoom · click node to jump to finding