PT-2025-50773 · Librechat · Librechat

Published 2025-12-11 · Updated 2025-12-15 · CVE-2025-66452

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LibreChat versions 0.8.0 and below

Description LibreChat, a ChatGPT clone with additional features, does not have a handler for JSON parsing errors. A SyntaxError originating from express.json() includes user input in the error message, which is then reflected in responses. This can lead to the exposure of user input, including HTML and JavaScript, in error responses. If the Content-Type is not strictly enforced, this creates a cross-site scripting (XSS) risk.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-66452

GHSA-Q6C5-GVJ5-C264

Affected Products

Librechat

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66452.json · Exploit
• https://github.com/danny-avila/LibreChat/security/advisories/GHSA-q6c5-gvj5-c264 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-66452 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-66452 · Security Note
• https://t.me/cveNotify/145789 · Telegram Post
• https://t.me/CVEtracker/39552 · Telegram Post