VulnerabilityDeferred

CVE-2026-54157

An attacker can use this to make arbitrary outbound requests from LobeHub's infrastructure, leak Vercel deployment details, and inject cookies on the lobehub.com domain through reflected Set-Cookie headers.

CRITICAL 9.0EPSS 1.83%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.83%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication. An attacker can use this to make arbitrary outbound requests from LobeHub's infrastructure, leak Vercel deployment details, and inject cookies on the lobehub.com domain through reflected Set-Cookie headers. This vulnerability is fixed in 2.1.57.

CVSS 3.1: 9.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H
EPSS: 1.83% probability · 78th percentile
CISA KEV: Not listed
Weakness: CWE-918
Source: security-advisories@github.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.