VulnerabilityDeferred

CVE-2026-23733

Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context.

MEDIUM 6.4EPSS 0.13%

Does this matter?

Lower severity and a low EPSS score (0.13%). Track it; it rarely justifies an emergency change on its own.

Description

LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE) by leveraging the exposed `electronAPI` IPC bridge, allowing attackers to run arbitrary system commands on the victim's machine. Version 2.0.0-next.180 patches the issue.

CVSS 3.1: 6.4 MEDIUMCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L
EPSS: 0.13% probability · 3th percentile
CISA KEV: Not listed
Weakness: CWE-94
Source: security-advisories@github.com

References

https://github.com/lobehub/lobe-chat/security/advisories/GHSA-4gpc-rhpj-9443

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.