CVEvulnerability

CVE-2026-23733

6.4 MEDIUM Published 2026-01-18 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2026-01-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.4 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L
Weaknesses
CWE-94

Description

LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE) by leveraging the exposed `electronAPI` IPC bridge, allowing attackers to run arbitrary system commands on the victim's machine. Version 2.0.0-next.180 patches the issue.

Related

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References