Skip to content
OpenAdvisories

Vendor

lobehub

22 known vulnerabilities.

Products

lobe-chat 12 lobehub 9 chat 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.7
    CVE-2026-23522

    Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion

    LobeChat is an open source chat application platform. Prior to version 2.0.0-next.193, `knowledgeBase.removeFilesFromKnowledgeBase` tRPC ep allows authenticated users to delete files from any knowledge base without verifying ownership. `userId` filter in the …

    lobehub lobe-chat @lobehub/chat npm
  • Low 3.0
    CVE-2025-62505

    SSRF in lobehub/lobe-chat with native web fetch module

    LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery (SSRF) in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array together with impls c…

    lobehub lobe-chat @lobehub/chat npm