JSON Parsing Error Handling in LibreChat by Danny Avila

CVE-2025-66452

What is CVE-2025-66452?

In LibreChat versions up to 0.8.0, a lack of proper error handling for JSON parsing can expose user input errors in error messages. When the express.json() method encounters a SyntaxError, it includes user input that could be HTML or JavaScript, potentially leading to Cross-Site Scripting (XSS) vulnerabilities if strict Content-Type headers are not enforced. This exposure allows attackers to inject harmful scripts that can be reflected in responses, posing a serious security risk.

References