Skip to content
OpenAdvisories

Package · npm

@lobehub/lobehub

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.2
    CVE-2026-42045

    LobeHub: Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE)

    LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.48, when LobeChat processes custom tags in the Render process of src/features/Portal/Artifacts/Body/Renderer/index.tsx, if no type matc…

    lobehub lobehub @lobehub/lobehub npm
  • Medium 5.0
    CVE-2026-39411

    LobeHub has an unauthenticated authentication bypass on `webapi` routes via forgeable `X-lobe-chat-auth` header

    LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.48, the webapi authentication layer trusts a client-controlled X-lobe-chat-auth header that is only XOR-obfuscated, not signed or other…

    lobehub lobehub @lobehub/lobehub npm