CVE-2024-32965
High · 8.1@lobehub/chat Server Side Request Forgery vulnerability
CVSS
8.1
EPSS
26.1%
Published
Nov 26, 2024
CISA due date
—
The record
lobe-chat before 1.19.13 has an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @lobehub/chat | 0 | 1.19.13 |
Related vulnerabilities
- GHSA-wrrr-8jcv-wjf5 LobeHub Vulnerable to Improper Authorization in Presigned Upload Also affects @lobehub/chat
- CVE-2026-23835 LobeHub is an open source human-and-AI-agent network. Also affects @lobehub/chat
- GHSA-4gpc-rhpj-9443 Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code… Also affects @lobehub/chat
- GHSA-j7xp-4mg9-x28r Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion Also affects @lobehub/chat
- CVE-2026-23522 LobeChat is an open source chat application platform. Also affects @lobehub/chat
- CVE-2026-23733 LobeChat is an open source chat application platform. Also affects @lobehub/chat
- CVE-2024-47066 lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) Also affects @lobehub/chat
- CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a… CWE-918