CVE-2025-66452: 
NixOS vulnerability analysis and mitigation

CVE-2025-66452 is a reflected Cross-Site Scripting (XSS) vulnerability in LibreChat, an open-source ChatGPT clone, affecting versions 0.8.0 and below. The flaw arises from unhandled JSON parsing errors in the Express.js middleware, where SyntaxError messages from express.json() reflect raw user input — including HTML and JavaScript — back in HTTP error responses. It was published on December 11, 2025, with no patch available at the time of initial disclosure. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is the absence of a JSON parsing error handler in LibreChat's Express.js backend (CWE-79: Improper Neutralization of Input During Web Page Generation). When a POST request with malformed JSON is submitted, express.json() throws a SyntaxError that includes the raw request body verbatim in the error message, which is then reflected in the HTTP 400 response with Content-Type: text/html. This creates an XSS vector if the response is rendered in a browser context without strict Content-Type enforcement. The vulnerability requires the attacker to send a crafted POST request with a valid Authorization header (authenticated user), and user interaction is needed for exploitation (GitHub Advisory).

Successful exploitation could allow an attacker to inject and execute arbitrary HTML or JavaScript in a victim's browser session, leading to session credential theft, account compromise, and unauthorized actions performed on behalf of the victim. The scope is changed (cross-origin impact possible), with low confidentiality and integrity impacts — primarily targeting user sessions rather than server-side data. Availability is not directly affected (GitHub Advisory, Red Hat CVE).

A proof-of-concept (PoC) curl command is publicly available in the GitHub Security Advisory, demonstrating how to trigger the reflected XSS via a crafted POST request body. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.054% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory).

1. Reconnaissance: Identify a LibreChat instance running version 0.8.0 or below. Obtain valid authentication credentials (the exploit requires a valid Authorization: Bearer JWT token and session cookie).
2. Craft malicious request: Construct a POST request to a LibreChat API endpoint (e.g., /d/prompts/<prompt_id>) with Content-Type: application/json and a body containing malformed JSON that embeds an HTML/JavaScript payload, such as: This is malicious <script>alert(document.domain)</script> "key": "value".
3. Submit the request: Send the crafted request using a tool like curl or Burp Suite, including the victim's session cookies and authorization token (or trick the victim into submitting it via a CSRF-style attack).
4. Trigger error reflection: The server's express.json() middleware fails to parse the malformed JSON, throws a SyntaxError, and reflects the entire raw request body — including the injected script — in the HTTP 400 response body with Content-Type: text/html.
5. Achieve XSS: If the error response is rendered in the victim's browser (e.g., via a crafted link or embedded request), the injected JavaScript executes in the context of the LibreChat origin, enabling session token theft or other malicious actions (GitHub Advisory).

• Network: Unusual POST requests to LibreChat API endpoints (e.g., /d/prompts/) containing malformed JSON bodies with embedded HTML tags (<script>, <img>, <svg>) or JavaScript event handlers in HTTP traffic logs.
• Logs: HTTP server access logs showing 400 Bad Request responses to POST endpoints with abnormally large or HTML-containing request bodies; response Content-Type: text/html on API endpoints that normally return JSON.
• Application: Error log entries from express.json() middleware containing SyntaxError with user-supplied HTML/JavaScript content embedded in the error message.

Users should upgrade LibreChat to a version beyond 0.8.0, as a patch was noted as available after initial publication (GitHub Advisory). As interim mitigations, administrators should implement a custom JSON parsing error handler in Express.js that returns a generic error message without reflecting user input, enforce strict Content-Type: application/json validation on all API responses, and deploy a Content Security Policy (CSP) to limit script execution. Additionally, all user-supplied input in error messages should be sanitized or omitted entirely before being included in responses.

The vulnerability was reported by security researcher zahangirbu and published via GitHub's security advisory program on December 11, 2025. The advisory was rated "Moderate" severity by the LibreChat maintainers, who acknowledged that while the XSS risk is partially mitigated by Content-Type enforcement in practice, user-supplied input should never be reflected in error responses on production applications (GitHub Advisory). No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified.