LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution
- Severity:
- Medium
Description
The vulnerability was automatically discovered by an ai agent and then manually verified.
LobeChat’s message rendering mechanism has a stored cross-site scripting (XSS) vulnerability.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 2.1.26
References
Related Issues
- Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE) - CVE-2026-23733
- beautiful-mermaid contains an SVG attribute injection issue that can lead to cross-site scripting (XSS) - CVE-2026-26226
- CyberChef has a Cross-site Scripting issue - CVE-2026-42615
- Slim Select has potential Cross-site Scripting issue - CVE-2024-9440
You might also like:
- Tags:
- npm
- @lobehub/lobehub
Anything's wrong? Let us know Last updated on May 13, 2026