VYPR
← All advisories
Medium severity6.4OSV Advisory· Published Jan 18, 2026· Updated Apr 15, 2026

CVE-2026-23733

CVE-2026-23733

Description

LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE) by leveraging the exposed electronAPI IPC bridge, allowing attackers to run arbitrary system commands on the victim's machine. Version 2.0.0-next.180 patches the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
@lobehub/chatnpm
<= 1.143.2—

Affected products

2
  • Lobehub/Lobe ChatOSV
    Range: 0.0.5-nightly-pr6474-20250409074602, pr-build-6474-0b4dba8534382f7a6592d8800f4b27e72f23c554, pr-build-6474-0d36602ed703878e5fb6f80015ad78829644a727, …
  • ghsa-coords
    pkg:npm/%40lobehub/chat
    Range: <= 1.143.2

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.