CVE-2026-54025

Name of the Vulnerable Software and Affected Versions LibreChat versions prior to 0.8.4-rc1

Description A flaw exists in the markdown artifact preview pipeline. The generateMarkdownHtml() function (located in client/src/utils/markdown.ts) utilizes a custom image renderer that triggers a fallback to the default renderer of the marked library (v15.0.12) when URLs pass the isSafeUrl allowlist check. This default renderer fails to HTML-escape double-quote characters within image alt text. An attacker can exploit this by crafting alt text containing double quotes and event handlers, such as " onload="payload, to break out of the attribute and execute arbitrary scripts in the victim's browser via the innerHTML property of the content element within the Sandpack preview iframe.

Recommendations Update to version 0.8.4-rc1.