GHSA-4gpc-rhpj-9443
Critical · 9.6CVSS
9.6
EPSS
—
Published
Jan 20, 2026
CISA due date
—
The record
Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @lobehub/chat | 0 | No fix |
Related vulnerabilities
- CVE-2026-23733 LobeChat is an open source chat application platform. Same vulnerability
- GHSA-wrrr-8jcv-wjf5 LobeHub Vulnerable to Improper Authorization in Presigned Upload Also affects @lobehub/chat
- CVE-2026-23835 LobeHub is an open source human-and-AI-agent network. Also affects @lobehub/chat
- GHSA-j7xp-4mg9-x28r Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion Also affects @lobehub/chat
- CVE-2026-23522 LobeChat is an open source chat application platform. Also affects @lobehub/chat
- CVE-2024-32965 @lobehub/chat Server Side Request Forgery vulnerability Also affects @lobehub/chat
- CVE-2024-47066 lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) Also affects @lobehub/chat
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94