Skip to contentLobehub Lobe-chat vulnerabilities
- lobehub lobe-chatlobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar UploadCVE-2026-725947.6 High
- lobehub lobe-chatLobeHub Vulnerable to Improper Authorization in Presigned UploadCVE-2026-23835Fix available5.7 Medium
- lobehub lobe-chatLobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File DeletionCVE-2026-235223.7 Low
- lobehub lobe-chatLobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE)CVE-2026-237336.4 Medium
- lobehub lobe-chatSSRF in lobehub/lobe-chat with native web fetch moduleCVE-2025-62505Fix available3.0 Low
- lobehub lobe-chat, lobe chat +1 morelobe-chat has an Open RedirectCVE-2025-59426Fix available4.3 Medium
- lobehub lobe-chat, lobe chat +1 moreLobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat MessagesCVE-2025-59417Fix available6.8 Medium
- lobehub lobe-chat, lobe chat +1 moressrf vulnerability in lobe-chatCVE-2024-32965Fix availableEPSS 26.1%8.1 High
- lobehub lobe chat, lobe-chat +1 moreLobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)CVE-2024-47066Public exploitFix availableEPSS 11.9%9.0 Critical
- lobehub lobe-chat, lobe chat +1 moreAPI Key Leak in lobe-chatCVE-2024-37895Fix available5.7 Medium
- lobehub lobe-chat, lobe chat +1 morelobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerabilityCVE-2024-32964Fix availableEPSS 53.0%9.0 Critical
- lobehub lobe chat, lobe-chat +1 moreLobe Chat unauthorized access to pluginsCVE-2024-24566Fix available5.3 Medium