[HIGH] LibreChat MCP Command Injection (CVE-2026-22252)

Command injection in LibreChat's MCP stdio transport allows an authenticated user to execute arbitrary shell commands via unsanitised stdio_config.command/args inputs. Affected versions unverified — under review; check the upstream advisory for the patched release tag.