GHSA-xq4x-622m-q8fq
Medium · 6.2CVSS
6.2
EPSS
—
Published
May 5, 2026
CISA due date
—
The record
LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | @lobehub/lobehub | 0 | No fix |
Related vulnerabilities
- CVE-2026-42045 LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent… Same vulnerability
- CVE-2026-54157 LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent… Also affects @lobehub/lobehub
- GHSA-xmwj-c75x-6346 LobeHub: Unauthenticated SSRF in `/webapi/proxy` Also affects @lobehub/lobehub
- CVE-2026-39411 LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent… Also affects @lobehub/lobehub
- GHSA-5mwj-v5jw-5c97 LobeHub: Unauthenticated authentication bypass on `webapi` routes via forgeable… Also affects @lobehub/lobehub
- CVE-2026-96376 Improper Neutralization of Special Elements used in an OS Command ("OS Command… CWE-78
- CVE-2026-113732 virtualenv is a tool for creating isolated virtual python environments. CWE-78
- CVE-2026-113776 virtualenv is a tool for creating isolated virtual python environments. CWE-78