PT-2025-50771 · Librechat · Librechat

Published 2025-12-11 · Updated 2025-12-12 · CVE-2025-66450

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions LibreChat versions 0.8.0 and below

Description A flaw exists in LibreChat versions 0.8.0 and below where modification of the iconURL parameter in a POST request allows an attacker to store malicious code within a chat. Sharing this chat with other users can lead to a loss of privacy for those who view the shared link, as resources loaded from the malicious link can compromise user data. The issue is related to cross-site scripting when sharing chat links.

Recommendations Update to version 0.8.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

CVE-2025-66450

GHSA-84VX-VMCF-XGPP

Affected Products

Librechat

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66450.json · Exploit
• https://github.com/danny-avila/LibreChat/commit/6fa94d3eb8f5779363226d10dccf8b01a735744c · Patch
• https://github.com/danny-avila/LibreChat/security/advisories/GHSA-84vx-vmcf-xgpp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66450 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66450 · Security Note
• https://t.me/CVEtracker/39550 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1999255465516003468 · Twitter Post