Read the docs

lobehub

Records22All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9

Exploited now

lobehub records in CISA KEV

No lobehub vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Lobe Chat 7 records HIGH Lobehub 1 record MEDIUM

Records

22 records

TI-2026-39067 CVE-2026-54157 · GHSA-xmwj-c75x-6346

LobeHub: Unauthenticated SSRF in `/webapi/proxy`

Priority HIGH 74

LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you.

CVSS 3.1CRITICAL 9.0 Network High privileges No interaction EPSS 0.0183 Published 2026-06-23 Fixed in 2.1.57 CWE-918
TI-2026-83681 CVE-2026-120315 · GHSA-7925-2fm7-xg83

Path traversal in LobeHub Chat lets users write arbitrary files

Priority HIGH 73

LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile().

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00436 Published 2026-11-02 Fixed in 2.1.49 CWE-22
TI-2024-21832 CVE-2024-32965 · GHSA-2xcc-vm3f-m8rw

ssrf vulnerability in lobe-chat

Priority HIGH 70

Lobe Chat is an open-source, AI chat framework.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.26131 Published 2024-11-26 Fixed in 1.19.13 CWE-918
TI-2026-42275 CVE-2026-59095 · GHSA-r2cx-cpfx-9h63

LobeChat < 2.2.10-canary.18 - SSRF via importFromUrl and fetchImageFromUrl

Priority HIGH 69

LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill…

CVSS 4.0HIGH 8.3 Network Low privileges No interaction EPSS 0.00402 Published 2026-07-02 Fixed in 2.2.10 CWE-918
TI-2026-42278 CVE-2026-59098 · GHSA-w676-mrp6-5fqq

LobeChat 2.2.9 - Cross-User Document Disclosure via Unscoped RAG Semantic Search

Priority MEDIUM 64

LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting miss…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00415 Published 2026-07-02 No fix listed CWE-639
TI-2026-42162 CVE-2026-58578 · GHSA-g4jq-25cx-3cw5

LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Import

Priority MEDIUM 64

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00548 Published 2026-07-02 Fixed in 2.2.10-canary.15 CWE-1333
TI-2025-36978 CVE-2025-59426 · GHSA-xph5-278p-26qx

lobe-chat has an Open Redirect

Priority MEDIUM 53

Lobe Chat is an open-source artificial intelligence chat framework.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00351 Published 2025-09-25 Fixed in 1.130.1 CWE-601
TI-2026-42280 CVE-2026-59100 · GHSA-hgpq-q5hf-7r77

LobeChat 2.2.9 - Broken Object Level Authorization via Chat-Group Agent Operations

Priority MEDIUM 45

LobeChat through 2.2.9 contains a broken object level authorization vulnerability that allows authenticated attackers to access and modify other users' chat-group agent data by supplying arbitrary group identifiers.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00291 Published 2026-07-02 No fix listed CWE-639
TI-2026-50851 CVE-2026-72594 · GHSA-cjxw-hmxq-h489

lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload

Priority LOW 33

A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a u…

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00284 Published 2026-08-10 No fix listed CWE-79
TI-2024-16187 CVE-2024-24566 · GHSA-pf55-fj96-xf37

Lobe Chat unauthorized access to plugins

Priority LOW 31

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00482 Published 2024-01-31 Fixed in 0.122.4 CWE-284
TI-2024-25211 CVE-2024-37895 · GHSA-p36r-qxgx-jq2v

API Key Leak in lobe-chat

Priority LOW 26

Lobe Chat is an open-source LLMs/AI chat framework.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00546 Published 2024-06-17 Fixed in 0.162.25 CWE-200
Open these records in search →