Skip to content
OpenAdvisories

Package · npm

@lobehub/lobehub

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • Critical 9.0
    CVE-2026-54157 Scanner template

    LobeHub: Unauthenticated SSRF in `/webapi/proxy`

    LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication.…

    lobehub lobehub @lobehub/lobehub npm
  • Medium 6.2
    CVE-2026-42045

    LobeHub: Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)

    LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.48, when LobeChat processes custom tags in the Render process of src/features/Portal/Artifacts/Body/Renderer/index.tsx, if no type matc…

    lobehub lobehub @lobehub/lobehub npm
  • Medium 5.0
    CVE-2026-39411

    LobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header

    LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.48, the webapi authentication layer trusts a client-controlled X-lobe-chat-auth header that is only XOR-obfuscated, not signed or other…

    lobehub lobehub @lobehub/lobehub npm