What’s Vulnerable › Products

lobehub lobe-chat vulnerabilities

12 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your lobehub lobe-chat version is affected

Latest lobehub lobe-chat vulnerabilities

• CVE-2026-72594 — lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload (CVSS 7.6)
• CVE-2026-23835 — LobeHub Vulnerable to Improper Authorization in Presigned Upload (CVSS 5.7)
• CVE-2026-23522 — Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion (CVSS 3.7)
• CVE-2026-23733 — Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE) (CVSS 6.4)
• CVE-2025-62505 — SSRF in lobehub/lobe-chat with native web fetch module (CVSS 3.0)
• CVE-2025-59426 — lobe-chat has an Open Redirect (CVSS 4.3)
• CVE-2025-59417 — Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages (CVSS 6.1)
• CVE-2024-32965 — ssrf vulnerability in lobe-chat (CVSS 8.6)
• CVE-2024-47066 — Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) (CVSS 8.8)
• CVE-2024-37895 — API Key Leak in lobe-chat (CVSS 5.7)
• CVE-2024-32964 — lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability (CVSS 9.0)
• CVE-2024-24566 — Lobe Chat unauthorized access to plugins (CVSS 5.3)