CVE-2026-23733

MEDIUM6.4

Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE)

Published Jan 18, 2026

Modified Yesterday

Details

LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE) by leveraging the exposed electronAPI IPC bridge, allowing attackers to run arbitrary system commands on the victim's machine. Version 2.0.0-next.180 patches the issue.

References

WEBhttps://github.com/lobehub/lobe-chat/security/advisories/GHSA-4gpc-rhpj-9443 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2026-23733

CVSS Analysis

CVSS v3.1

6.4

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

HighAC:H

Privileges Required

HighPR:H

User Interaction

RequiredUI:R

Scope

ChangedS:C

Impact

Confidentiality

HighC:H

Integrity

LowI:L

Availability

LowA:L

6.4/CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L

Weakness Type (CWE)

Injection

CWE-94

Code Injection

Ecosystems

Timeline

PublishedJan 18, 2026

ModifiedJan 18, 2026