Input Validation Flaw in LibreChat's PATCH API Endpoint
CVE-2025-66451

5.3MEDIUM

Key Information:

Vendor

Danny-avila

Status
Librechat
Vendor
CVE Published:
11 December 2025

What is CVE-2025-66451?

LibreChat, a variant of ChatGPT with enhanced functionalities, presents a critical input validation issue in versions up to 0.8.0. This security flaw allows users to craft JSON requests that improperly modify prompt definitions through the PATCH endpoint intended for prompt groups. Specifically, the patchPromptGroup function does not sufficiently filter sensitive fields before passing req.body to the updatePromptGroup function. This oversight can potentially lead to unintended modifications, affecting the application's expected behavior and integrity. Users are advised to upgrade to version 0.8.1 or later, which addresses this vulnerability.

Affected Version(s)

LibreChat < 0.8.1

References

https://github.com/danny-avila/LibreChat/security/advisor...
x_refsource_CONFIRM
https://github.com/danny-avila/LibreChat/commit/01413eea3...
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-66451 : Input Validation Flaw in LibreChat's PATCH API Endpoint