LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE) by leveraging the exposed `electronAPI` IPC bridge, allowing attackers to run arbitrary system commands on the victim's machine. Version 2.0.0-next.180 patches the issue.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Sun, 18 Jan 2026 23:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE) by leveraging the exposed `electronAPI` IPC bridge, allowing attackers to run arbitrary system commands on the victim's machine. Version 2.0.0-next.180 patches the issue. | |
| Title | Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE) | |
| Weaknesses | CWE-94 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-01-18T22:56:15.888Z
Reserved: 2026-01-15T15:45:01.957Z
Link: CVE-2026-23733
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-01-18T23:15:48.710
Modified: 2026-01-18T23:15:48.710
Link: CVE-2026-23733
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses