https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 10:28:58 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-330364 EUVD-2026-330364 https://cve.radiocsirt.org/vuln/euvd-2026-330364 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54025 <p>LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, there is a vulnerability in LibreChat&#39;s markdown artifact preview pipeline. The marked library v15.0.12 does not HTML-escape double-quote characters in image alt text when a custom renderer falls through to the default renderer. LibreChat&#39;s generateMarkdownHtml function (in client/src/utils/markdown.ts) installs a custom image renderer that returns false for URLs passing the isSafeUrl allowlist check, which causes marked to fall back to its built-in renderer. That built-in renderer inserts the raw alt text into the alt=&#34;...&#34; attribute without escaping double-quote characters. An attacker can craft an alt text such as &#34; onload=&#34;payload to break out of the attribute and inject an arbitrary event handler. The resulting HTML is then assigned to document.getElementById(&#39;content&#39;).innerHTML inside the Sandpack preview iframe, causing the payload to execute in the victim&#39;s browser. This vulnerability is fixed in 0.8.4-rc1.</p> <p>LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, there is a vulnerability in LibreChat&#39;s markdown artifact preview pipeline. The marked library v15.0.12 does not HTML-escape double-quote characters in image alt text when a custom renderer falls through to the default renderer. LibreChat&#39;s generateMarkdownHtml function (in client/src/utils/markdown.ts) installs a custom image renderer that returns false for URLs passing the isSafeUrl allowlist check, which causes marked to fall back to its built-in renderer. That built-in renderer inserts the raw alt text into the alt=&#34;...&#34; attribute without escaping double-quote characters. An attacker can craft an alt text such as &#34; onload=&#34;payload to break out of the attribute and inject an arbitrary event handler. The resulting HTML is then assigned to document.getElementById(&#39;content&#39;).innerHTML inside the Sandpack preview iframe, causing the payload to execute in the victim&#39;s browser. This vulnerability is fixed in 0.8.4-rc1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54025