LobeChat vulnerabilities and CVEs
The Beam CVE database tracks 11 security advisories for LobeChat: 2 critical, 1 high, 6 medium and 2 low severity. The newest is CVE-2026-23835, published Feb 1, 2026 and fixed in 1.143.3.
An open-source chat front end for many model providers, with plugins and agent features.
Check your version: npm ls @lobehub/chat
- Vulnerabilities tracked
- 11
- Critical
- 2
- Known exploited (CISA KEV)
- 0
- Published in the last 30 days
- 0
All entries, newest first
CVE-2026-23835
LobeHub Vulnerable to Improper Authorization in Presigned Upload
medium5.7Feb 1, 2026CVE-2026-23522
Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion
low3.7No fixJan 20, 2026CVE-2026-23733
Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)
critical9.6No fixJan 20, 2026CVE-2025-62505
Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module
low3.0Oct 17, 2025CVE-2025-59426
lobe-chat has an Open Redirect
medium4.3Sep 24, 2025CVE-2025-59417
Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages
medium6.8Sep 18, 2025CVE-2024-32965
@lobehub/chat Server Side Request Forgery vulnerability
high8.1Nov 26, 2024CVE-2024-47066
lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)
medium9.0Sep 23, 2024CVE-2024-37895
Lobe Chat API Key Leak
medium5.7Jun 17, 2024CVE-2024-32964
lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability
critical9.0May 10, 2024CVE-2024-24566
@lobehub/chat vulnerable to unauthorized access to plugins
medium5.3Jan 31, 2024