CVE-2025-66451

MediumCVSS 6.5/10Last modified Oct 7, 2026

Description

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when creating prompts, JSON requests are sent to define and modify the prompts via PATCH endpoint for prompt groups (/api/prompts/groups/:groupId). However, the request bodies are not sufficiently validated for proper input, enabling users to modify prompts in a way that was not intended as part of the front end system. The patchPromptGroup function passes req.body directly to updatePromptGroup() without filtering sensitive fields. This issue is fixed in version 0.8.1.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20 CWE-915

Affected software

No affected versions have been published.

Timeline

Published: Dec 11, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-664526.1LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, there is no handler for JSON parsing errors; SyntaxError CVE-2025-664537.5Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application p CVE-2025-664546.5Arcade MCP allows you to to create, deploy, and share MCP Servers. Prior to 1.5.4, the arcade-mcp HTTP server uses a hardcoded default worke CVE-2025-664559.8LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, CVE-2025-664569.8Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4 CVE-2025-664578.8Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4 CVE-2025-664586.1Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.CVE-2025-664596.1Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.CVE-2025-66463.3PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to discl CVE-2025-664606.1Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.CVE-2025-664618.4FULLBACK Manager Pro provided by GS Yuasa International Ltd. registers two Windows services with unquoted file paths. A user may execute ar CVE-2025-664678.1Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned.