LibreChat CVE-2025-66452

Exploitation requires that the affected endpoint's JSON error response (the express.json() SyntaxError containing reflected user input) is NOT served with a strictly enforced non-HTML Content-Type - the description explicitly scopes the XSS risk to 'if Content-Type isn't strictly enforced.' The attacker must also induce a victim to send a crafted request containing a malformed JSON body with embedded HTML/JavaScript (UI:P / passive user interaction), e.g. via a malicious link or auto-submitting page. Limiting factors: impact depends on how the error response is rendered by the browser (content-type sniffing/handling), the reflected XSS is non-persistent so each victim must be individually lured, and only LibreChat versions 0.8.0 and below are affected. No authentication is required (PR:N).

This is a moderate-severity reflected XSS (CWE-79) in LibreChat ≤0.8.0 where Express's express.json() SyntaxError, which embeds the offending user input, is reflected into HTTP error responses with no sanitizing error handler. The provided CVSS is a 4.0 vector (5.3, AV:N/AC:L/PR:N/UI:P) indicating a network-reachable, unauthenticated flaw with low confidentiality and integrity impact but requiring passive user interaction (UI:P) - consistent with a reflected rather than stored XSS. Real-world risk signals are modest and internally consistent: EPSS is 0.22% (11th percentile, low probability of exploitation), the issue is NOT on the CISA KEV list, and there is no evidence of active exploitation. A publicly available exploit reference exists (the GitHub Security Advisory GHSA-q6c5-gvj5-c264), but POC availability is a distinct signal from active exploitation and should not be conflated with it. Critically, the vulnerability description itself qualifies the impact as conditional - XSS only arises 'if Content-Type isn't strictly enforced' - meaning exploitability depends on deployment/configuration specifics and attacker ability to control how the error is rendered. Net assessment: a legitimate but lower-tier priority (reflected XSS, user-interaction-dependent, conditional on content-type handling), not a high-urgency widespread threat. Mitigating factor to verify: no official fix existed at publication, so defenders cannot simply patch and must apply compensating controls.

An attacker crafts a URL or form that causes a victim's browser to submit a malformed JSON body to a LibreChat endpoint, embedding HTML/JavaScript in the payload. Because express.json() reflects the invalid input in its SyntaxError message and no error handler sanitizes it, the script is returned in the response and can execute in the victim's browser if the response Content-Type is not strictly enforced as non-HTML. A publicly available exploit reference exists in the vendor's GitHub Security Advisory; successful attacks require luring the victim into triggering the crafted request (UI:P).