CVE-2025-66452
NoneCVSS
—
EPSS
0.2%
Published
Dec 11, 2025
CISA due date
—
The record
LibreChat's lack of JSON parsing error handling can lead to XSS
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | librechat | 0 | 0.8.2-r1 |
| Chainguard | librechat-compat | 0 | 0.8.2-r1 |
| Chainguard | librechat-dev | 0 | 0.8.2-r1 |
Related vulnerabilities
- CVE-2026-27138 Certificate verification can panic when a certificate in the chain has an empty DNS name… Also affects librechat
- CVE-2026-27137 When verifying a certificate chain which contains a certificate containing multiple email… Also affects librechat
- CVE-2026-29087 @hono/node-server allows running the Hono application on Node.js. Also affects librechat
- CVE-2026-29074 SVGO, short for SVG Optimizer, is a Node.js library and command-line application for… Also affects librechat
- CVE-2026-29045 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects librechat
- CVE-2026-29085 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects librechat
- CVE-2026-29086 Hono is a Web application framework that provides support for any JavaScript runtime. Also affects librechat
- GHSA-xpqw-6gx7-v673 SVGO DoS through entity expansion in DOCTYPE (Billion Laughs) Also affects librechat