CVE-2025-66451: 
NixOS vulnerability analysis and mitigation

CVE-2025-66451 is an improper input validation vulnerability in LibreChat, an open-source ChatGPT-like application, affecting versions 0.8.0 and below. The flaw exists in the PATCH endpoint for prompt groups (/api/prompts/groups/:groupId), where the patchPromptGroup function passes req.body directly to updatePromptGroup() without filtering sensitive fields, allowing authenticated users to modify prompt ownership metadata beyond what the frontend permits. It was disclosed on December 11, 2025, with a fix released in version 0.8.1. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-20 (Improper Input Validation) and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). The vulnerable patchPromptGroup function in api/server/routes/prompts.js directly passes the entire req.body to the database update function without stripping sensitive fields such as author, authorName, _id, productionId, createdAt, and __v. An authenticated attacker can craft a PATCH request to /api/prompts/groups/:groupId with arbitrary values for these fields, effectively reassigning prompt ownership to another user's GUID or an invalid value. A public proof-of-concept using curl commands is included in the GitHub Security Advisory, demonstrating the full exploit flow (GitHub Advisory, Patch Commit).

Successful exploitation allows an authenticated user to modify the author and authorName fields of any prompt group they have access to, effectively hijacking or orphaning prompts. A victim whose prompt's author field is changed to an invalid or different GUID loses the ability to modify or manage that prompt, receiving an "Error updating prompt group" response on subsequent operations. Additionally, an attacker could potentially reassign a prompt's ownership to their own GUID, gaining unauthorized access to another user's prompts. The vulnerability has no direct confidentiality or availability impact but poses a significant integrity risk to prompt management within the platform (GitHub Advisory).

A working proof-of-concept is publicly documented in the GitHub Security Advisory, requiring only standard HTTP tools such as curl. Exploitation requires a low-privilege authenticated session (valid JWT token) and no user interaction beyond sending a crafted PATCH request. The EPSS score is approximately 0.06%, indicating low probability of widespread automated exploitation. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory, Red Hat CVE).

1. Authenticate: Obtain a valid JWT access token and refresh token by logging into the LibreChat instance as any registered user.
2. Enumerate target prompt: Send a GET request to /api/prompts/groups/:groupId with the Authorization header to retrieve the prompt group's current metadata, including author (GUID), authorName, _id, and productionId.
3. Craft malicious PATCH request: Construct a PATCH request to /api/prompts/groups/:groupId with a JSON body that includes the sensitive fields with modified values — for example, changing author to another user's GUID or a random value, and authorName to an arbitrary string.
4. Submit the request: Send the PATCH request with the crafted body. The server accepts and applies all fields without validation, returning HTTP 200 OK with the updated (tampered) prompt group data.
5. Verify impact: Confirm that the original owner can no longer modify the prompt (receives "Error updating prompt group"), or that the attacker's GUID is now listed as the owner, granting them unauthorized control (GitHub Advisory).

• Network: Unexpected PATCH requests to /api/prompts/groups/<groupId> containing sensitive fields (author, authorName, _id, productionId, createdAt, __v) in the JSON body that differ from the authenticated user's own identity.
• Logs: Server access logs showing PATCH requests to /api/prompts/groups/ endpoints from users who do not own the targeted prompt group; subsequent GET requests to the same endpoint returning a different author or authorName than previously recorded.
• Application Behavior: Users reporting inability to edit or delete their own prompts, receiving "Error updating prompt group" errors after a PATCH request was made by another user to the same resource.

Upgrade LibreChat to version 0.8.1, which introduces the safeValidatePromptGroupUpdate function that validates and sanitizes PATCH request bodies, rejecting any request containing sensitive fields (author, authorName, _id, productionId, createdAt, __v) with a 400 Bad Request response. The fix also adds a handleJsonParseError middleware for improved JSON parsing error handling. No configuration-based workaround is available for unpatched versions; upgrading is the only remediation (Patch Commit, GitHub Advisory).

The vulnerability was reported by security researcher zahangirbu and acknowledged by the LibreChat maintainers, who released a patch promptly in version 0.8.1. The advisory was rated "Moderate" severity by GitHub. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability tracking platforms (GitHub Advisory).