CVE-2025-66450
Last modified
CVE-2025-66450 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when a user posts a question, the iconURL parameter of the POST request can be modified by an attacker. EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when a user posts a question, the iconURL parameter of the POST request can be modified by an attacker. The malicious code is then stored in the chat which can then be shared to other users. When sharing chats with a potentially malicious “tracker”, resources loaded can lead to loss of privacy for users who view the chat link that is sent to them. This issue is fixed in version 0.8.1.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Librechat | Librechat | < 0.8.1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-66450?
How severe is CVE-2025-66450?
How do I fix CVE-2025-66450?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-66445Authorization bypass vulnerability in Hitachi Infrastructure…7.1
- CVE-2025-66446MaxKB is an open-source AI assistant for enterprise. Version…7.5
- CVE-2025-66447Chamilo LMS is a learning management system. From 1.11.0 to …4.7
- CVE-2025-66448vLLM is an inference and serving engine for large language m…8.8
- CVE-2025-66449ConvertXis a self-hosted online file converter. In versions …8.8
- CVE-2025-6645PDF-XChange Editor U3D File Parsing Use-After-Free Remote Co…7.8
- CVE-2025-66451LibreChat is a ChatGPT clone with additional features. In ve…6.5
- CVE-2025-66452LibreChat is a ChatGPT clone with additional features. In ve…6.1
- CVE-2025-66453Rhino is an open-source implementation of JavaScript written…7.5
- CVE-2025-66454Arcade MCP allows you to to create, deploy, and share MCP Se…6.5
- CVE-2025-66456Elysia is a Typescript framework for request validation, typ…9.8
- CVE-2025-66457Elysia is a Typescript framework for request validation, typ…8.8
Are you affected by CVE-2025-66450?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST