{"data":{"id":"45aab18d-0695-46c5-82f9-1bb8b52ba4fc","title":"CVE-2025-66451: LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when creating prompts, JSON…","summary":"CVE-2025-66451 affects LibreChat versions 0.8.0 and below. The PATCH endpoint for prompt groups (/api/prompts/groups/:groupId) does not sufficiently validate request bodies, so users can modify prompts in ways the front end does not intend. The patchPromptGroup function passes req.body directly to updatePromptGroup() without filtering sensitive fields.","solution":"Fixed in version 0.8.1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66451","publishedAt":"2025-12-12T04:15:50.690Z","cveId":"CVE-2025-66451","cweIds":["CWE-20","CWE-915"],"cvssScore":"6.5","cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["LibreChat"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"LibreChat prompt group PATCH endpoint accepts unvalidated request bodies","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00333,"epssCheckedAt":"2026-11-04T06:10:14.410Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-11-04T06:10:23.807Z","patchAvailable":null,"disclosureDate":null,"fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[]}}