Priority HIGH 73
LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile().
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00436 · Published 2026-11-02 · Fixed in 2.1.49 CWE-22
Priority HIGH 70
LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00201 · Published 2026-09-04 · No fix listed CWE-345
Priority LOW 33
A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a u…
CVSS 3.1HIGH 7.6· Network · Low privileges · User interaction · EPSS 0.00284 · Published 2026-08-10 · No fix listed CWE-79
Priority MEDIUM 45
LobeChat through 2.2.9 contains a broken object level authorization vulnerability that allows authenticated attackers to access and modify other users' chat-group agent data by supplying arbitrary group identifiers.
CVSS 4.0LOW 2.3· Network · Low privileges · No interaction · EPSS 0.00291 · Published 2026-07-02 · No fix listed CWE-639
Priority MEDIUM 64
LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authenticated attackers to access other users' data by exploiting miss…
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00415 · Published 2026-07-02 · No fix listed CWE-639
Priority HIGH 69
LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill…
CVSS 4.0HIGH 8.3· Network · Low privileges · No interaction · EPSS 0.00402 · Published 2026-07-02 · Fixed in 2.2.10 CWE-918
Priority MEDIUM 60
LobeChat through 2.2.9 server-database deployments are vulnerable to broken object-level authorization in MessageModel.
CVSS 4.0MEDIUM 6.0· Network · Low privileges · No interaction · EPSS 0.0025 · Published 2026-07-02 · No fix listed CWE-639
Priority MEDIUM 64
LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking…
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00548 · Published 2026-07-02 · Fixed in 2.2.10-canary.15 CWE-1333
Priority HIGH 74
LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you.
CVSS 3.1CRITICAL 9.0· Network · High privileges · No interaction · EPSS 0.0183 · Published 2026-06-23 · Fixed in 2.1.57 CWE-918
Priority MEDIUM 61
LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you.
CVSS 3.1MEDIUM 6.2· Network · High privileges · User interaction · EPSS 0.00266 · Published 2026-05-12 · Fixed in 2.1.48 CWE-79
Priority MEDIUM 64
LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00131 · Published 2026-04-08 · Fixed in 2.1.48 CWE-287
Priority MEDIUM 59
LobeHub is an open source human-and-AI-agent network.
CVSS 4.0MEDIUM 5.7· Network · Low privileges · No interaction · EPSS 0.00366 · Published 2026-01-30 · Fixed in 1.143.3 CWE-73
Priority MEDIUM 51
LobeChat is an open source chat application platform.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00235 · Published 2026-01-19 · Fixed in 2.0.0-next.193 CWE-284
Priority LOW 27
LobeChat is an open source chat application platform.
CVSS 3.1MEDIUM 6.4· Local · High privileges · User interaction · EPSS 0.00146 · Published 2026-01-18 · Fixed in 2.0.0-next.180 CWE-94
Priority MEDIUM 48
LobeChat is an open source chat application platform.
CVSS 3.1LOW 3.0· Network · High privileges · No interaction · EPSS 0.00322 · Published 2025-10-17 · Fixed in 1.136.2 CWE-918
Priority MEDIUM 53
Lobe Chat is an open-source artificial intelligence chat framework.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00351 · Published 2025-09-25 · Fixed in 1.130.1 CWE-601
Priority HIGH 65
Lobe Chat is an open-source artificial intelligence chat framework.
CVSS 4.0MEDIUM 6.8· Network · No auth · User interaction · EPSS 0.00432 · Published 2025-09-18 · Fixed in 1.129.4 CWE-79
Priority HIGH 70
Lobe Chat is an open-source, AI chat framework.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.26131 · Published 2024-11-26 · Fixed in 1.19.13 CWE-918
Priority HIGH 72
Lobe Chat is an open-source artificial intelligence chat framework.
CVSS 3.1CRITICAL 9.0· Network · High privileges · No interaction · EPSS 0.1186 · Published 2024-09-23 · Fixed in 1.19.13 CWE-918
Priority LOW 26
Lobe Chat is an open-source LLMs/AI chat framework.
CVSS 3.1MEDIUM 5.7· Network · Low privileges · User interaction · EPSS 0.00546 · Published 2024-06-17 · Fixed in 0.162.25 CWE-200
Priority HIGH 72
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system.
CVSS 3.1CRITICAL 9.0· Network · High privileges · No interaction · EPSS 0.52964 · Published 2024-05-10 · Fixed in 0.150.6 CWE-918
Priority LOW 31
Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00482 · Published 2024-01-31 · Fixed in 0.122.4 CWE-284
THREATIST.IORead the docs