CVE-2025-66452

MediumCVSS 6.1/10Last modified Oct 7, 2026

Description

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, there is no handler for JSON parsing errors; SyntaxError from express.json() includes user input in the error message, which gets reflected in responses. User input (including HTML/JavaScript) can be exposed in error responses, creating an XSS risk if Content-Type isn't strictly enforced. This issue does not have a fix at the time of publication.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Dec 11, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-664537.5Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application p CVE-2025-664546.5Arcade MCP allows you to to create, deploy, and share MCP Servers. Prior to 1.5.4, the arcade-mcp HTTP server uses a hardcoded default worke CVE-2025-664559.8LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, CVE-2025-664569.8Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4 CVE-2025-664578.8Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4 CVE-2025-664586.1Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.CVE-2025-664596.1Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.CVE-2025-66463.3PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to discl CVE-2025-664606.1Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to 1.CVE-2025-664618.4FULLBACK Manager Pro provided by GS Yuasa International Ltd. registers two Windows services with unquoted file paths. A user may execute ar CVE-2025-664678.1Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned. CVE-2025-664686.1The Aimeos GrapesJS CMS extension provides page editor for creating content pages based on extensible components. Prior to 2021.10.8, 2022.1