{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"2.1.26"}],"component":"@lobehub/lobehub","cve_ids":["CVE-2026-42045"],"ecosystem":"npm","epss":0.00266,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-xq4x-622m-q8fq","id":"tcs_01M5KGJJHS6FTJWKTXTRK1S25A","modified_at":"2026-05-13T16:33:36.818743Z","published_at":"2026-05-05T18:04:53Z","references":["https://osv.dev/vulnerability/GHSA-xq4x-622m-q8fq","https://github.com/lobehub/lobehub/security/advisories/GHSA-xq4x-622m-q8fq","https://nvd.nist.gov/vuln/detail/CVE-2026-42045","https://github.com/lobehub/lobehub"],"severity":{"label":"medium","score":6.2},"sources":[{"source":"osv","source_id":"GHSA-xq4x-622m-q8fq","url":"https://osv.dev/vulnerability/GHSA-xq4x-622m-q8fq"}],"summary":"LobeHub has a Cross-Site Scripting issue that escalates to Remote Code Execution"}