CVE-2025-69222

{
  "id": "CVE-2025-69222",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-69222",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-07T21:33:50.883724Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.3,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "danny-avila",
          "product": "LibreChat",
          "versions": [
            {
              "status": "affected",
              "version": ">= 0.8.1-rc2, 0.8.2-rc2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-07T22:15:43.523",
  "references": [
    {
      "url": "https://github.com/danny-avila/LibreChat/commit/3b41e392ba5c0d603c1737d8582875e04eaa6e02",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/danny-avila/LibreChat/releases/tag/v0.8.2-rc2",
      "tags": [
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/danny-avila/LibreChat/security/advisories/GHSA-rgjq-4q58-m3q8",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 is prone to a server-side request forgery (SSRF)\nvulnerability due to missing restrictions of the Actions feature in the default configuration. LibreChat enables users to configure agents with predefined instructions and actions that can interact with remote services via OpenAPI specifications, supporting various HTTP methods, parameters, and authentication methods including custom headers. By default, there are no restrictions on accessible services, which means agents can also access internal components like the RAG API included in the default Docker Compose setup. This issue is fixed in version 0.8.1-rc2."
    },
    {
      "lang": "es",
      "value": "LibreChat es un clon de ChatGPT con características adicionales. La versión 0.8.1-rc2 es propensa a una vulnerabilidad de falsificación de petición del lado del servidor (SSRF) debido a la falta de restricciones de la característica Acciones en la configuración predeterminada. LibreChat permite a los usuarios configurar agentes con instrucciones y acciones predefinidas que pueden interactuar con servicios remotos a través de especificaciones OpenAPI, admitiendo varios métodos HTTP, parámetros y métodos de autenticación, incluyendo encabezados personalizados. Por defecto, no hay restricciones en los servicios accesibles, lo que significa que los agentes también pueden acceder a componentes internos como la API RAG incluida en la configuración predeterminada de Docker Compose. Este problema está solucionado en la versión 0.8.1-rc2."
    }
  ],
  "lastModified": "2026-09-30T23:10:00.237",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:librechat:librechat:0.8.1:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98BB9E92-2D0E-4975-A966-734F3858551B"
            },
            {
              "criteria": "cpe:2.3:a:librechat:librechat:0.8.1:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8DAB7F45-699A-4383-ABEA-D4374E58EE95"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}