Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages

Description

We identified a cross-site scripting (XSS) vulnerability when handling chat message in lobe-chat that can be escalated to remote code execution on the user’s machine.

Recommendation

Update the @lobehub/chat package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.129.3
• Patched version(s): 1.129.4

References

• GHSA-m79r-r765-5f9j
• CVE-2025-59417
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Regular Expression Denial of Service (ReDoS) in lodash (GHSA-29mw-wpgm-hmr9) 3 - CVE-2020-28500
• Regular Expression Denial of Service (ReDoS) in lodash (GHSA-x5rq-j2xg-h7qm) - CVE-2019-1010266
• lobe-chat has an Open Redirect - CVE-2025-59426
• Payload's SQLite adapter Session Fixation vulnerability (GHSA-26rv-h2hf-3fw4) 2 - CVE-2025-4644

Tags:

npm

@lobehub/chat