Skip to content
OpenAdvisories

Product · lobehub

lobe-chat

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.6
    CVE-2026-72594

    lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload

    A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar.

    lobehub lobe-chat
  • High 8.1
    CVE-2024-32965 EPSS 26%

    ssrf vulnerability in lobe-chat

    Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive informa…

    lobehub lobe-chat @lobehub/chat npm