Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@lobehub/chat

11 known vulnerabilities (2 critical, 1 high, 6 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
11 · 2 critical, 1 high, 6 medium, 2 low
Registry
npm

Advisories 11

  • CVE-2026-23835Medium 5.7

    LobeHub Vulnerable to Improper Authorization in Presigned Upload

    Affected: fixed in 1.143.3.

  • Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion

    Affected: through 1.143.2.

  • CVE-2026-23733Medium 6.4

    Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE)

    Affected: through 1.143.2.

  • SSRF in lobehub/lobe-chat with native web fetch module

    Affected: fixed in 1.136.2.

  • CVE-2025-59426Medium 4.3

    lobe-chat has an Open Redirect

    Affected: fixed in 1.130.1.

  • CVE-2025-59417Medium 6.8

    Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages

    Affected: fixed in 1.129.4.

  • ssrf vulnerability in lobe-chat

    Affected: fixed in 1.19.13.

  • CVE-2024-47066Critical 9.0

    Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)

    Affected: fixed in 1.19.13.

  • CVE-2024-37895Medium 5.7

    API Key Leak in lobe-chat

    Affected: fixed in 0.162.25.

  • CVE-2024-32964Critical 9.0

    lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

    Affected: fixed in 0.150.6.

  • CVE-2024-24566Medium 5.3

    Lobe Chat unauthorized access to plugins

    Affected: fixed in 0.122.4.