# @lobehub/chat (npm) vulnerabilities

11 known vulnerabilities (2 critical, 1 high, 6 medium, 2 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://www.npmjs.com/package/@lobehub/chat

## Advisories (11)

### [CVE-2026-23835](https://cve.now/CVE-2026-23835): LobeHub Vulnerable to Improper Authorization in Presigned Upload

- Severity: Medium 5.7
- Published: Jan 30, 2026
- Affected: fixed in 1.143.3.

### [CVE-2026-23522](https://cve.now/CVE-2026-23522): Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion

- Severity: Low 3.7
- Published: Jan 19, 2026
- Affected: through 1.143.2.

### [CVE-2026-23733](https://cve.now/CVE-2026-23733): Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE)

- Severity: Medium 6.4
- Published: Jan 18, 2026
- Affected: through 1.143.2.

### [CVE-2025-62505](https://cve.now/CVE-2025-62505): SSRF in lobehub/lobe-chat with native web fetch module

- Severity: Low 3.0
- Published: Oct 17, 2025
- Affected: fixed in 1.136.2.

### [CVE-2025-59426](https://cve.now/CVE-2025-59426): lobe-chat has an Open Redirect

- Severity: Medium 4.3
- Published: Sep 25, 2025
- Affected: fixed in 1.130.1.

### [CVE-2025-59417](https://cve.now/CVE-2025-59417): Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages

- Severity: Medium 6.8
- Published: Sep 18, 2025
- Affected: fixed in 1.129.4.

### [CVE-2024-32965](https://cve.now/CVE-2024-32965): ssrf vulnerability in lobe-chat

- Severity: High 8.1
- Published: Nov 26, 2024
- Affected: fixed in 1.19.13.

### [CVE-2024-47066](https://cve.now/CVE-2024-47066): Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)

- Severity: Critical 9.0
- Published: Sep 23, 2024
- Affected: fixed in 1.19.13.

### [CVE-2024-37895](https://cve.now/CVE-2024-37895): API Key Leak in lobe-chat

- Severity: Medium 5.7
- Published: Jun 17, 2024
- Affected: fixed in 0.162.25.

### [CVE-2024-32964](https://cve.now/CVE-2024-32964): lobe-chat \`/api/proxy\` endpoint Server-Side Request Forgery vulnerability

- Severity: Critical 9.0
- Published: May 10, 2024
- Affected: fixed in 0.150.6.

### [CVE-2024-24566](https://cve.now/CVE-2024-24566): Lobe Chat unauthorized access to plugins

- Severity: Medium 5.3
- Published: Jan 31, 2024
- Affected: fixed in 0.122.4.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/@lobehub/chat
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.