HIGH 7.6 NVD

CVE-2026-72594

A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript

A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar.

References

https://github.com/lobehub/lobe-chat

Published: 2026-08-10 · Source: NVD · Feed updated: 2026-08-10

This high severity vulnerability with a CVSS score of 7.6 was published on 2026-08-10 via NVD.

vulnfeed aggregates 9095 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.