Vulnerability · Published Jul 2, 2026 · Assigned by VulnCheck

CVE-2026-58578LobeChat < 2.2.10-canary.15 - Regular Expression Denial of Service in GitHub Skill Import

Medium 6.5

In plain English

A medium-severity regular-expression denial of service in lobehub from lobehub. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 53.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craft a malicious basePath value containing unescaped regex metacharacters such as catastrophic-backtracking patterns, which are injected into a dynamically constructed regular expression in the findSkillMd function and executed synchronously against archive entries, denying service to all concurrent users for tens of seconds per request.

Affected products (as reported)

Vendor	Product	Versions
lobehub	lobehub	0 – before 2.2.10-canary.15

Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Release Notes release-notes
Researcher Disclosure exploit, technical-description
Fix PR issue-tracking
Fix Commit patch
https://www.vulncheck.com/advisories/lobechat-canary-15-regular-expression-denial-of-service-in-github-skill-import third-party-advisory