Server-Side Request Forgery in LibreChat by Danny Avila

CVE-2025-66201

What is CVE-2025-66201?

LibreChat, a ChatGPT clone developed by Danny Avila, is susceptible to a Server-side Request Forgery vulnerability due to improper handling of specially crafted OpenAPI specifications in its 'Actions' feature. This flaw allows authenticated users with access to this functionality to manipulate the system into accessing internal URLs that should remain protected. Such an exploit can lead to potential unauthorized access, including compromising cloud metadata services, where server impersonation might be feasible. Users are advised to upgrade to version 0.8.1-rc2 where this vulnerability has been resolved.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References