CVE-2026-72594: lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload

Severity: high (CVSS 7.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-10 · updated 2026-10-24
Weakness: CWE-79

Description

A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar.

Affected products

lobehub lobe-chat: through 2.2.13

References

https://github.com/lobehub/lobe-chat

Get alerted when CVE-2026-72594 or the next vulnerability affects your stack