Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages

Description

We identified a cross-site scripting (XSS) vulnerability when handling chat message in lobe-chat that can be escalated to remote code execution on the user’s machine.

Recommendation

Update the @lobehub/chat package to the latest compatible version. Followings are version details:

• Affected version(s): <= 1.129.3
• Patched version(s): 1.129.4

References

• GHSA-m79r-r765-5f9j
• CVE-2025-59417
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE) - CVE-2026-23733
• Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module - CVE-2025-62505
• MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server - CVE-2025-58444
• Fiora chat user avatar is vulnerable to XSS via SVG files - CVE-2025-56514

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

@lobehub/chat