Skip to content
CVE PROGRAM SOURCE RECORD7.6 High

CVE-2026-72594

lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TuranSec

Description

A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

lobehub lobe-chat

Default version status: unknown

  • 0 to ≤ 2.2.13affected

References