Which versions of LibreChat are affected by CVE-2025-66450?

LibreChat versions 0.8.0 and earlier contain a stored cross-site scripting and tracker-injection flaw in shared chat links, allowing an attacker who can create a chat to persist a malicious icon URL…. A patch is available.

Is there a public PoC exploit available for CVE-2025-66450?

Yes, a public proof-of-concept exploit is available for CVE-2025-66450. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-66450?

Within 24 hours, identify all LibreChat deployments running 0.8.0 or earlier and determine whether chat sharing is enabled; if so, temporarily disable sharing or restrict it to trusted users, and notify affected user groups. Within 7 days, upgrade all affected instances to LibreChat 0.8.1 or later, verify the update, and review logs for suspicious iconURL values or unexpected outbound requests from shared chats. Within 30 days, confirm enterprise-wide remediation, update configuration standards to require review of shared-chat features, and report residual risk to security management, noting publicly available exploit code exists and no CISA KEV listing.

LibreChat CVE-2025-66450

Q: What is the CVSS score of CVE-2025-66450?

CVE-2025-66450 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

HIGH

Basic XSS (CWE-80)

2025-12-11 security-advisories@github.com

XSS Librechat

8.6

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Attacker must be an authenticated user to post and share a chat (PR:L), the victim must open the shared link (UI:R), the stored content executes/loads in the victim's browser context (S:C), with limited privacy/integrity impact and no availability loss.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Oct 07, 2026 - 20:50 vuln.today

CVE Published

Dec 11, 2025 - 22:15 cve.org

HIGH 8.6

DescriptionCVE.org

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when a user posts a question, the iconURL parameter of the POST request can be modified by an attacker. The malicious code is then stored in the chat which can then be shared to other users. When sharing chats with a potentially malicious “tracker”, resources loaded can lead to loss of privacy for users who view the chat link that is sent to them. This issue is fixed in version 0.8.1.

AnalysisAI

Stored cross-site scripting and tracker injection in LibreChat 0.8.0 and earlier allow a user who can create a chat to control the iconURL parameter of the chat-creation POST request, persisting an attacker-supplied URL inside the conversation so that anyone who opens a shared link to that chat loads the external resource - enabling privacy loss through tracking beacons and, per the CWE-80 classification, HTML/script injection in the viewer's browser. The issue is fixed in version 0.8.1 and publicly available exploit details exist in the GitHub security advisory GHSA-84vx-vmcf-xgpp, but EPSS is only 0.21% (11th percentile) with no CISA KEV entry, so real-world exploitation pressure is low. Scoring is contentious: NVD rates it 8.6 under CVSS 4.0 (PR:N), whereas independent assessment rates it moderate under CVSS 3.1 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N), because delivery requires a poster with an account, the chat-sharing feature to be enabled, and a victim to actively open the shared link - limiting practical impact to tracking/injected content rather than full account compromise.

Technical ContextAI

The root cause is CWE-80, improper neutralization of script-related HTML tags (basic cross-site scripting), arising from an unsafe data flow in LibreChat's conversation-creation pipeline. In affected builds, the api/server/middleware/buildEndpointOption.js middleware copied a client-supplied iconURL from the request body into the stored conversation preset and, in non-enforced model-spec mode, left the caller-provided value untouched, so an arbitrary URL was persisted with the chat object and later rendered as a resource reference when the chat was viewed or shared. Because chat sharing produces a link that other users open, the attacker-controlled URL is effectively stored XSS delivered to any viewer, and even a plain tracking pixel leaks viewer IP, referrer and viewing behavior. The official fix (commit 6fa94d3eb8f5779363226d10dccf8b01a735744c) no longer trusts the request body: for enforced model specs it assigns currentModelSpec.iconURL to parsedBody and, for non-enforced mode, derives iconURL server-side by looking up the selected spec in appConfig.modelSpecs.list; it also adds parseCompactConvo sanitization tests confirming iconURL is stripped for the OpenAI, agents, anthropic, google and assistants endpoints while other conversation fields (model, temperature, top_p, promptPrefix, maxContextTokens) are preserved. The affected component is the LibreChat web application (CPE cpe:2.3:a:librechat:librechat:*:*:*:*:*:*:*:*), a self-hosted ChatGPT-style chat UI with multi-provider endpoints, so exposure is instance-specific and depends on operators enabling public registration and chat sharing.

RemediationAI

Upgrade LibreChat to version 0.8.1, the vendor-released fix that stops trusting the client-supplied iconURL and instead derives it server-side from model-spec configuration; the change is contained in commit 6fa94d3eb8f5779363226d10dccf8b01a735744c and described in advisory GHSA-84vx-vmcf-xgpp. If an immediate upgrade is not possible, operators should disable or restrict the chat-sharing feature (the delivery vector for the stored payload), which removes the ability for one user's malicious chat to load resources in another user's browser but also removes a core collaboration feature; alternatively, place a reverse proxy or WAF rule in front of the instance that strips or rejects an iconURL field in POST bodies to the chat-creation endpoint, though this can break legitimate per-chat icon customization. Adding a strict Content-Security-Policy with an img-src/connect-src allowlist on the LibreChat origin will block outbound loads to arbitrary attacker-controlled hosts and is a useful compensating control with low side effects, provided CSP is not already relaxed for other features. Restricting account creation or requiring admin approval for new users reduces the population of potential posters but does not fix the underlying stored-XSS sink, so the 0.8.1 upgrade remains the only complete resolution.