What is the CVSS score of CVE-2026-72594?

CVE-2026-72594 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Lobe Chat are affected by CVE-2026-72594?

A stored cross-site scripting vulnerability in lobe-chat v2.2.13 and earlier allows authenticated users to inject malicious code into profile avatars that executes when colleagues view their…. A patch is available.

How to fix or mitigate CVE-2026-72594?

Within 24 hours, disable SVG file uploads in user profiles and notify all lobe-chat users of the vulnerability; audit recent avatar uploads for suspicious activity. Within 7 days, deploy server-side SVG sanitization (e.g., DOMPurify or comparable library) and implement strict Content-Type validation that rejects SVG files regardless of filename. Within 30 days, establish continuous monitoring for exploitation evidence in access logs, implement Content Security Policy headers to block inline scripts, and monitor the lobe-chat GitHub repository for an available vendor patch to plan your upgrade.

Lobe Chat CVE-2026-72594

EUVD-2026-55164 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-10 TuranSec

GHSA-cjxw-hmxq-h489

XSS Lobe Chat Lobehub

7.6

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

vuln.today AI

7.6 HIGH

PR:L because a valid low-privilege account is required to upload the avatar; S:C and C:H because XSS executes in victims' browser contexts enabling full session compromise.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Aug 10, 2026 - 12:17 EUVD

Analysis Generated

Aug 10, 2026 - 11:28 vuln.today

CVE Published

Aug 10, 2026 - 10:41 cve.org

HIGH 7.6

DescriptionCVE.org

A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar. The avatar upload handler derives the stored file extension and S3 content type from the original filename rather than inspecting file content, enabling an attacker to store an SVG containing a script element that executes in the browser of any user who views the attacker's profile or avatar.

AnalysisAI

Stored XSS in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to persist malicious JavaScript in the application by uploading an SVG file as a profile avatar. The avatar upload pipeline trusts the client-supplied filename to determine both the stored file extension and the S3 content-type header, so a crafted SVG containing a script element is stored and later served with a permissive content type. Any user who subsequently views the attacker's profile or avatar triggers execution of the injected script in their browser, enabling session theft or further client-side attacks. No public exploit code has been identified at time of analysis.

Technical ContextAI

The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored variant where attacker-controlled content is persisted server-side and later reflected to other users. The affected component is the avatar upload handler in lobehub/lobe-chat (CPE: cpe:2.3:a:lobehub:lobe-chat:*:*:*:*:*:*:*:*), which integrates with S3-compatible object storage. The handler performs no magic-byte or MIME sniffing on uploaded file content; instead it derives both the stored file extension and the S3 Content-Type header solely from the original filename provided by the client. An SVG file is valid XML that browsers render as a document and within which script elements are natively executed. When the stored SVG is later fetched and rendered in a victim's browser - for example when loading the attacker's profile - the embedded script runs in the context of the lobe-chat application origin, which may have access to session tokens, local storage, and API credentials.

RemediationAI

No vendor-released patch with a specific fixed version number has been identified at time of analysis; the CVE covers versions through v2.2.13 and users should monitor the upstream repository at https://github.com/lobehub/lobe-chat for a patched release. As an immediate compensating control, administrators can restrict the avatar upload feature by disabling or rate-limiting the upload endpoint at the reverse proxy or API gateway layer - this prevents new malicious SVGs from being stored, though it also disables legitimate avatar customization. Alternatively, operators can configure the S3 bucket or CDN serving stored avatars to append a Content-Disposition: attachment header for all SVG responses, which forces browsers to download rather than render SVG files and blocks script execution; this may break inline avatar display depending on how the frontend retrieves images. A content security policy (CSP) header on the lobe-chat origin that disallows inline scripts can reduce impact depth but will not prevent the SVG from being fetched or the browser from initiating rendering. Until a patch is available, the most reliable mitigation is server-side file content inspection (magic-byte or libmagic validation) on avatar uploads, rejecting any upload whose content does not match an allow-listed raster image type (JPEG, PNG, WebP, GIF).