HIGH8.1npm
GHSA-2xcc-vm3f-m8rw· CVE-2024-32965@lobehub/chat Server Side Request Forgery vulnerability
Modified: 11/26/2024
package
npm/@lobehub/chat
pkg:npm/%40lobehub/chat
CRITICAL9.0npm
GHSA-3fc8-2r3f-8wrg· CVE-2024-47066lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)
Modified: 2/4/2026
CRITICAL9.6npm
GHSA-4gpc-rhpj-9443· CVE-2026-23733Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)
Modified: 2/5/2026
LOW3.0npm
GHSA-fgx4-p8xf-qhp9· CVE-2025-62505Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module
Modified: 10/17/2025
LOW3.7npm
GHSA-j7xp-4mg9-x28r· CVE-2026-23522Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion
Modified: 2/3/2026
MEDIUMnpm
GHSA-m79r-r765-5f9j· CVE-2025-59417Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages
Modified: 9/10/2026
CRITICAL9.0npm
GHSA-mxhq-xw3g-rphc· CVE-2024-32964lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability
Modified: 2/4/2026
MEDIUM5.7npm
GHSA-p36r-qxgx-jq2v· CVE-2024-37895Lobe Chat API Key Leak
Modified: 9/10/2026
MEDIUM5.3npm
GHSA-pf55-fj96-xf37· CVE-2024-24566@lobehub/chat vulnerable to unauthorized access to plugins
Modified: 9/10/2026
MEDIUMnpm
GHSA-wrrr-8jcv-wjf5· CVE-2026-23835LobeHub Vulnerable to Improper Authorization in Presigned Upload
Modified: 2/3/2026
MEDIUM4.3npm
GHSA-xph5-278p-26qx· CVE-2025-59426lobe-chat has an Open Redirect
Modified: 9/10/2026