{"data":{"id":"6670e927-0967-43ce-98f6-d27fe20bb312","title":"CVE-2025-59417: Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.129.4, there is a a cross-site…","summary":"Lobe Chat versions prior to 1.129.4 contain a cross-site scripting flaw in chat message handling. When a server response includes a lobeArtifact tag with type image/svg+xml, the SVGRender component inserts the content through dangerouslySetInnerHTML, enabling XSS that can be escalated to remote code execution on the user's machine. Anyone able to inject content into chat messages, such as through a malicious page used for prompt injection, a compromised MCP server, or tool integrations, can exploit it.","solution":"Fixed in 1.129.4.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-59417","publishedAt":"2025-09-18T15:15:38.557Z","cveId":"CVE-2025-59417","cweIds":["CWE-79"],"cvssScore":"6.1","cvssSeverity":"medium","severity":"medium","attackType":["prompt_injection","other"],"issueType":"vulnerability","affectedPackages":["@lobehub/chat@<= 1.129.3 (fixed: 1.129.4)"],"affectedPackageNames":["@lobehub/chat"],"affectedPackageRefs":["npm:@lobehub/chat"],"affectedVendors":[],"affectedVendorsRaw":["Lobe Chat"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Lobe Chat cross-site scripting in chat messages via SVG artifacts","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00432,"epssCheckedAt":"2026-11-04T06:10:15.713Z","kevDateAdded":null,"advisoryAliases":["GHSA-m79r-r765-5f9j"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:52:40.900Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-09-18T05:04:43.614Z","daysToFix":0,"fixCheckedAt":"2026-10-29T21:43:44.074Z","capecIds":["CAPEC-198","CAPEC-86"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"framework","llmSpecific":true,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":["AML.T0051"],"fixes":[{"ecosystem":"npm","name":"@lobehub/chat","fixedVersion":"1.129.4","matchedVersion":"1.129.4","fixReleasedAt":"2025-09-18T05:04:43.614Z","daysToFix":0,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:43:43.923Z"}]}}