Description
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| lobehub | lobe-chat | < 0.122.4 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @lobehub/chat | < 0.122.4 | 0.122.4 | GHSA-pf55-fj96-xf37 |