CVE-2026-72594
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar.
Risk Assessment
An attacker can execute malicious scripts in other users' browsers, potentially leading to session theft, account takeover, or spreading malicious content.
Recommendation
Update lobe-chat to a patched version. Restrict allowed file types and sanitize SVG content.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar.