CVE-2026-23733

The record

LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE) by leveraging the exposed `electronAPI` IPC bridge, allowing attackers to run arbitrary system commands on the victim's machine. Version 2.0.0-next.180 patches the issue.

Affected packages

Related vulnerabilities

• GHSA-4gpc-rhpj-9443 Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code… Same vulnerability
• GHSA-wrrr-8jcv-wjf5 LobeHub Vulnerable to Improper Authorization in Presigned Upload Also affects @lobehub/chat
• CVE-2026-23835 LobeHub is an open source human-and-AI-agent network. Also affects @lobehub/chat
• GHSA-j7xp-4mg9-x28r Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion Also affects @lobehub/chat
• CVE-2026-23522 LobeChat is an open source chat application platform. Also affects @lobehub/chat
• CVE-2024-32965 @lobehub/chat Server Side Request Forgery vulnerability Also affects @lobehub/chat
• CVE-2024-47066 lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) Also affects @lobehub/chat
• CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94