lobehub has 4 CVEs on record between 2025 and 2026. 1 was published in the last 90 days. The median CVSS is 7.1 (high), with 1 rated critical. Most affected products: lobehub (2), @lobehub/lobehub (1), lobe_chat (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 1 prev 2
Worst active — by depth score
CVE-2026-54157Critical· 9.0LobeHub: Unauthenticated SSRF in `/webapi/proxy`62CVE-2026-59095High· 7.7LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service (…54CVE-2026-85621Medium· 6.5LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters48CVE-2025-59426Medium· 4.3Lobe Chat is an open-source artificial intelligence chat framework24
lobehub vulnerabilities
CVEs affecting lobehub, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-85621Medium· 6.5PoCLobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters
LobeChat (LobeHub) 2.2.1 does not properly verify inbound chat-platform webhook signatures in the QQ and Feishu adapters. The webhook route (/api/agent/webhooks/:platform) is unauthenticated by design and delegates verification to each a…
CVE-2026-59095High· 7.7PoCLobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service (…
LobeChat before 2.2.10-canary.18 contains a server-side request forgery vulnerability that allows authenticated attackers to direct internal HTTP requests to arbitrary URLs by supplying user-controlled input to the skill import service (…
CVE-2026-54157Critical· 9.0PoCLobeHub: Unauthenticated SSRF in `/webapi/proxy`
LobeHub: Unauthenticated SSRF in `/webapi/proxy`
CVE-2025-59426Medium· 4.3Lobe Chat is an open-source artificial intelligence chat framework
Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.130.1, the project's OIDC redirect handling logic constructs the host and protocol of the final redirect URL based on the X-Forwarded-Host or Host hea…