Vulnerability · Published Jan 18, 2026 · Assigned by GitHub_M
CVE-2026-23733Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE)
Medium 6.4
In plain English
A medium-severity code injection in lobe-chat from lobehub. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).
Official description
LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE) by leveraging the exposed `electronAPI` IPC bridge, allowing attackers to run arbitrary system commands on the victim's machine. Version 2.0.0-next.180 patches the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @lobehub/chat | no fix listed | GHSA-4gpc-rhpj-9443 |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L
References
- https://github.com/lobehub/lobe-chat/security/advisories/GHSA-4gpc-rhpj-9443 x_refsource_CONFIRM