CVE-2025-66450: 
NixOS vulnerability analysis and mitigation

CVE-2025-66450 is a stored Cross-Site Scripting (XSS) / remote resource inclusion vulnerability in LibreChat, an open-source ChatGPT clone. Affecting versions 0.8.0 and below, the flaw allows an authenticated attacker to inject a malicious iconURL value into a chat POST request, which is then persisted in the chat history and can be shared with other users. When victims view the shared chat link, their browsers load resources from the attacker-controlled URL, enabling privacy loss and potential stored XSS. It was published on December 11, 2025, and patched in version 0.8.1. The CVSS v3.1 base score is 5.4 (Medium), while the CVSS v4.0 base score is 8.6 (High) (GitHub Advisory, Red Hat CVE).

The root cause is insufficient input validation of the iconURL parameter in the chat POST request body (CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page). The application accepted client-supplied iconURL values without sanitization and stored them server-side in the chat history; the parseCompactConvo function did not strip this field before persisting it. When a shared chat is rendered, the stored URL is loaded as an image resource in victims' browsers, enabling tracking pixel attacks and potentially stored XSS on image upload. The fix, applied in commit 6fa94d3, strips iconURL from client input in parseCompactConvo and derives it exclusively server-side from model spec configuration (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker to embed attacker-controlled external resource URLs (e.g., tracking pixels or malicious scripts) into shared chat sessions, causing victims' browsers to silently load resources from untrusted origins. This leads to loss of user privacy (IP address, browser fingerprint, session metadata leakage), and under certain conditions may escalate to stored XSS enabling session hijacking, theft of sensitive user data, or execution of arbitrary JavaScript in victims' browsers. The scope is changed, meaning impact extends beyond the originating user to any recipient of a shared chat link (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating exploitation via a crafted curl command that injects a malicious iconURL into the agents chat endpoint. Exploitation requires a low-privileged authenticated account to inject the payload, but victim interaction is only passive (viewing a shared chat link). There is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.047% (very low probability of near-term exploitation). The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Authenticate: Log in to a LibreChat instance running version 0.8.0 or earlier with any valid user account.
2. Identify a target agent: Note the agent_id of an available agent (e.g., agent_Ak5qr6U-GFJ4ympk6xCNP).
3. Craft malicious POST request: Intercept or manually craft a POST request to /api/agents/chat/agents, modifying the iconURL field to point to an attacker-controlled resource (e.g., a tracking pixel at https://attacker.example.com/track.png?session=victim).
4. Submit the request: Send the crafted request with valid authentication cookies/Bearer token. The server stores the malicious iconURL in the chat history without validation.
5. Share the chat: Use LibreChat's chat sharing feature to generate a shareable link for the conversation containing the injected iconURL.
6. Deliver to victims: Send the shared chat link to target users. When victims open the link, their browsers automatically load the attacker-controlled resource, leaking their IP address, browser metadata, and potentially enabling stored XSS payload execution (GitHub Advisory).

• Network: Outbound HTTP requests from victim browsers to unexpected external domains when viewing shared LibreChat chat links; requests to known tracking pixel domains or attacker-controlled image hosting services embedded in chat history.
• Logs: LibreChat server access logs showing POST requests to /api/agents/chat/agents with iconURL values pointing to external, non-whitelisted domains; unusual iconURL values in stored chat records in the database.
• Application Data: Chat history records in the database containing iconURL fields with external URLs not matching configured model spec icons or the application's own asset paths.
• Browser: Network traffic from victim browsers showing image/resource requests to unexpected third-party domains immediately upon loading a shared chat link (GitHub Advisory).

The primary remediation is to upgrade LibreChat to version 0.8.1 or later, which strips the iconURL field from all client-supplied input and derives it exclusively from server-side model spec configuration. As a workaround for those unable to upgrade immediately, administrators should implement a Content Security Policy (CSP) restricting image sources (img-src) to trusted domains, disable or restrict the chat sharing feature, and apply strict input validation/allowlisting for any URL fields. Monitoring for unusual iconURL values in POST requests is also recommended (GitHub Advisory, Patch Commit).

The vulnerability was reported by researcher zahangirbu and disclosed via GitHub's coordinated security advisory process on December 11, 2025. Red Hat tracked the CVE in their security database. No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified at this time (GitHub Advisory, Red Hat CVE).