{"action":"Upgrade @lobehub/chat to 1.136.2 or later.","affected":[{"fixed":"1.136.2","introduced":"0"}],"component":"@lobehub/chat","cve_ids":["CVE-2025-62505"],"ecosystem":"npm","epss":0.00322,"exploited":false,"fixed_versions":["1.136.2"],"ghsa_id":"GHSA-fgx4-p8xf-qhp9","id":"tcs_01M5KFNGWRSAQ6XZRVVPJ4K1E2","modified_at":"2025-10-17T21:32:47Z","published_at":"2025-10-17T17:46:09Z","references":["https://osv.dev/vulnerability/GHSA-fgx4-p8xf-qhp9","https://github.com/lobehub/lobe-chat/security/advisories/GHSA-fgx4-p8xf-qhp9","https://nvd.nist.gov/vuln/detail/CVE-2025-62505","https://github.com/lobehub/lobe-chat/commit/8d59583dca16f218b99213d641733d8ba77f182c","https://github.com/lobehub/lobe-chat","https://github.com/lobehub/lobe-chat/blob/d942a635b36a231156c60d824afa573af8032572/packages/web-crawler/src/crawImpl/naive.ts#L39-L45"],"severity":{"label":"low","score":3},"sources":[{"source":"osv","source_id":"GHSA-fgx4-p8xf-qhp9","url":"https://osv.dev/vulnerability/GHSA-fgx4-p8xf-qhp9"}],"summary":"Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module"}