CVE-2025-66450

Katalog CVE

CVSS 5.4 · Medium EPSS 0,21%

Kerentanan Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) pada librechat. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when a user posts a question, the iconURL parameter of the POST request can be modified by an attacker. The malicious code is then stored in the chat which can then be shared to other users. When sharing chats with a potentially malicious “tracker”, resources loaded can lead to loss of privacy for users who view the chat link that is sent to them. This issue is fixed in version 0.8.1.

Rincian

Terbit di NVD

11 Desember 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/danny-avila/LibreChat/security/advisories/GHSA-84vx-vmcf-xgpp exploit · advisory vendor
• https://github.com/danny-avila/LibreChat/commit/6fa94d3eb8f5779363226d10dccf8b01a735744c patch