VDB
CVE-2025-66452
CVE-2025-66452
PUBLISHED
CVSS 5.300000190734863 MEDIUM
LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, there is no handler for JSON parsing errors; SyntaxError from express.json() includes user input in the error message, which gets reflected in responses. User input (including HTML/JavaScript) can be exposed in error responses, creating an XSS risk if Content-Type isn't strictly enforced. This issue does not have a fix at the time of publication.
EPSS 0.03% · 10.6th percentile
Risk Scores
CVSS v4.0
5.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS Score
0.03%
10.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| librechat | librechat | 0 |
| danny-avila | LibreChat | <= 0.8.1 |
Timeline
- Dec 1, 2025 CVE ID Reserved
- Dec 11, 2025 CVE Published
- Dec 11, 2025 PoC Published
- Dec 12, 2025 EPSS Score
- Dec 12, 2025 CVE Updated
- Dec 16, 2025 EPSS Score
- Dec 20, 2025 EPSS Score
- Dec 24, 2025 EPSS Score
- Dec 28, 2025 EPSS Score
- Jan 1, 2026 EPSS Score
- Jan 5, 2026 EPSS Score
- Jan 9, 2026 EPSS Score