{"action":"Upgrade @lobehub/chat to 1.129.4 or later.","affected":[{"fixed":"1.129.4","introduced":"0"}],"component":"@lobehub/chat","cve_ids":["CVE-2025-59417"],"ecosystem":"npm","epss":0.00432,"exploited":false,"fixed_versions":["1.129.4"],"ghsa_id":"GHSA-m79r-r765-5f9j","id":"tcs_01M5KFZZJAA28KM9M95FXKR6CP","modified_at":"2026-09-10T03:50:28.527046113Z","published_at":"2025-09-18T20:04:54Z","references":["https://osv.dev/vulnerability/GHSA-m79r-r765-5f9j","https://github.com/lobehub/lobe-chat/security/advisories/GHSA-m79r-r765-5f9j","https://nvd.nist.gov/vuln/detail/CVE-2025-59417","https://github.com/lobehub/lobe-chat/commit/9f044edd07ce102fe9f4b2fb47c62191c36da05c","https://github.com/lobehub/lobe-chat","https://github.com/lobehub/lobe-chat/blob/0a1dcf943ea294e35acbe57d07f7974efede8e2e/apps/desktop/src/main/controllers/SystemCtr.ts#L65-L68","https://github.com/lobehub/lobe-chat/blob/0a1dcf943ea294e35acbe57d07f7974efede8e2e/src/features/Conversation/components/MarkdownElements/LobeArtifact/index.ts#L7-L11","https://github.com/lobehub/lobe-chat/blob/0a1dcf943ea294e35acbe57d07f7974efede8e2e/src/features/Conversation/components/MarkdownElements/LobeArtifact/rehypePlugin.ts#L50-L68","https://github.com/lobehub/lobe-chat/blob/0a1dcf943ea294e35acbe57d07f7974efede8e2e/src/features/Portal/Artifacts/Body/Renderer/SVG.tsx#L67-L79","https://github.com/lobehub/lobe-chat/blob/0a1dcf943ea294e35acbe57d07f7974efede8e2e/src/features/Portal/Artifacts/Body/Renderer/index.tsx#L10-L32"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-m79r-r765-5f9j","url":"https://osv.dev/vulnerability/GHSA-m79r-r765-5f9j"},{"source":"nvd","source_id":"CVE-2025-59417","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59417"}],"summary":"Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages"}