Skip to content
OpenAdvisories

Vendor

lobehub

22 known vulnerabilities.

Products

lobe-chat 12 lobehub 9 chat 1
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.8
    CVE-2026-120315

    LobeHub Chat 1.84.26 before 2.1.49 Path Traversal RCE via writeTempFile

    LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile(). Attackers can create a file record via file.createFile with a trav…

    lobehub chat
  • High 7.6
    CVE-2026-72594

    lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload

    A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar.

    lobehub lobe-chat
  • High 7.7
    CVE-2026-59095

    LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl

    LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service (importFromUrl) and top…

    lobehub lobehub
  • High 8.1
    CVE-2024-32965 EPSS 26%

    ssrf vulnerability in lobe-chat

    Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive informa…

    lobehub lobe-chat @lobehub/chat npm