CVE-2026-23733CWE-94

Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE)

Medium · published January 18, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
3.5
In the wild
Unconfirmed
What it is

LobeChat is an open source chat application platform. Prior to version 2.0.0-next.180, a stored Cross-Site Scripting (XSS) vulnerability in the Mermaid artifact renderer allows attackers to execute arbitrary JavaScript within the application context. This XSS can be escalated to Remote Code Execution (RCE) by leveraging the exposed `electronAPI` IPC bridge, allowing attackers to run arbitrary system commands on the victim's machine. Version 2.0.0-next.180 patches the issue.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00146 · 3.5th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-01-18T22:56Z
EPSS history
Timeline
  • 18 JAN 22:56Z
    Lobe Chat has Cross-Site Scripting (XSS) issue that may escalate to Remote Code Execution (RCE)
    cvelistv5