PT-2025-48355 · Danny Avila · Librechat

Published 2025-11-29 · Updated 2025-11-29 · CVE-2025-66201

NVD

CVSS v4.0

8.6

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.1-rc2, LibreChat is vulnerable to Server-side Request Forgery (SSRF), by passing specially crafted OpenAPI specs to its "Actions" feature and making the LLM use those actions. It could be used by an authenticated user with access to this feature to access URLs only accessible to the LibreChat server (such as cloud metadata services, through which impersonation of the server might be possible). This issue has been patched in version 0.8.1-rc2.

Fix

RCE

SSRF

Weakness Enumeration

CWE-20

CWE-918

Related Identifiers

CVE-2025-66201

Affected Products

Librechat

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2025-66201 · Security Note
• https://github.com/danny-avila/LibreChat/security/advisories/GHSA-7m2q-fjwr-5x8v · Note