lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

Description

The latest version of lobe-chat(by now v0.141.2) has an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information.

Recommendation

Update the @lobehub/chat package to the latest compatible version. Followings are version details:

• Affected version(s): <= 0.150.5
• Patched version(s): 0.150.6

References

• GHSA-mxhq-xw3g-rphc
• CVE-2024-32964
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages - CVE-2025-59417
• Volto affected by possible DoS by invoking specific URL by anonymous user - CVE-2025-58047
• Potential DoS when using ContextLines integration (GHSA-r5w7-f542-q2j4) 10 - Vulnerability
• @intlify/shared Prototype Pollution vulnerability (GHSA-hjwq-mjwj-4x6c) 3 - CVE-2024-52810

Tags:

npm

@lobehub/chat