npm/@lobehub/chat CVE-2025-59417: medium 6.1, EPSS 0.43%

Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages

Action: Upgrade @lobehub/chat to 1.129.4 or later.

npm i @lobehub/chat@1.129.4

Affected

Fixed versions

Sources

• osv: GHSA-m79r-r765-5f9j
• nvd: CVE-2025-59417
• https://github.com/lobehub/lobe-chat/security/advisories/GHSA-m79r-r765-5f9j
• https://github.com/lobehub/lobe-chat/commit/9f044edd07ce102fe9f4b2fb47c62191c36da05c
• https://github.com/lobehub/lobe-chat
• https://github.com/lobehub/lobe-chat/blob/0a1dcf943ea294e35acbe57d07f7974efede8e2e/apps/desktop/src/main/controllers/SystemCtr.ts#L65-L68
• https://github.com/lobehub/lobe-chat/blob/0a1dcf943ea294e35acbe57d07f7974efede8e2e/src/features/Conversation/components/MarkdownElements/LobeArtifact/index.ts#L7-L11
• https://github.com/lobehub/lobe-chat/blob/0a1dcf943ea294e35acbe57d07f7974efede8e2e/src/features/Conversation/components/MarkdownElements/LobeArtifact/rehypePlugin.ts#L50-L68
• https://github.com/lobehub/lobe-chat/blob/0a1dcf943ea294e35acbe57d07f7974efede8e2e/src/features/Portal/Artifacts/Body/Renderer/SVG.tsx#L67-L79
• https://github.com/lobehub/lobe-chat/blob/0a1dcf943ea294e35acbe57d07f7974efede8e2e/src/features/Portal/Artifacts/Body/Renderer/index.tsx#L10-L32

CVE-2025-59417 · published 2025-09-18T20:04:54Z · modified 2026-09-10T03:50:28.527046113Z · JSON