Skip to content
OpenAdvisories

Vendor

lobehub

22 known vulnerabilities.

Products

lobe-chat 12 lobehub 9 chat 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.0
    CVE-2026-54157 Scanner template

    LobeHub: Unauthenticated SSRF in `/webapi/proxy`

    LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication.…

    lobehub lobehub @lobehub/lobehub npm
  • Critical 9.0
    CVE-2024-47066 Public exploit EPSS 12%

    Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)

    Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in `src/app/api/proxy/route.ts` does not consider redirect and could be bypassed when attacker provides an externa…

    lobehub lobe-chat @lobehub/chat npm
  • Critical 9.0
    CVE-2024-32964 Scanner template EPSS 53%

    lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

    Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can cons…

    lobehub lobe-chat @lobehub/chat npm