CVE-2026-72594

lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload PUBLISHED

Description (CNA)

A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar.

Affected (CNA)

Vendor / product	Versions
lobehub / lobe-chat	affected 0 through 2.2.13

CWE

CWE-79

References

https://github.com/lobehub/lobe-chat

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.