Medium severity6.4OSV Advisory· Published Jan 18, 2026· Updated Apr 15, 2026

CVE-2026-23733

Description

LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE) by leveraging the exposed electronAPI IPC bridge, allowing attackers to run arbitrary system commands on the victim's machine. Version 2.0.0-next.180 patches the issue.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
@lobehub/chatnpm	<= 1.143.2	—

Affected products

Lobehub/Lobe ChatOSV
Range: 0.0.5-nightly-pr6474-20250409074602, pr-build-6474-0b4dba8534382f7a6592d8800f4b27e72f23c554, pr-build-6474-0d36602ed703878e5fb6f80015ad78829644a727, …

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/advisories/GHSA-4gpc-rhpj-9443ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2026-23733ghsaADVISORY
github.com/lobehub/lobe-chat/security/advisories/GHSA-4gpc-rhpj-9443nvdWEB
github.com/lobehub/lobehub/security/advisories/GHSA-4gpc-rhpj-9443ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.416
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000