CVE-2025-59417 Lobe Chat Desktop Vulnerable to Remote Code Execution via XSS in Chat Messages
Attackers can achieve remote code execution on user machines via XSS in chat messages rendered as SVG, requiring an upgrade to Lobe Chat.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-59417?
CVE-2025-59417 is a medium-severity cross-site scripting vulnerability in lobehub lobe-chat, published on 18 Sep 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.129.4, there is a a cross-site scripting (XSS) vulnerability when handling chat message in lobe-chat that can be escalated to remote code execution on the user’s machine. In lobe-chat, when the response from the server is like <lobeArtifact identifier="ai-new-interpretation" ...> , it will be rendered with the lobeArtifact node, instead of the plain text. However, when the type of the lobeArtifact is image/svg+xml , it will be rendered as the SVGRender component, which internally uses dangerouslySetInnerHTML to set the content of the svg, resulting in XSS attack. Any party capable of injecting content into chat messages, such as hosting a malicious page for prompt injection, operating a compromised MCP server, or leveraging tool integrations, can exploit this vulnerability. This vulnerability is fixed in 1.129.4.
Weakness: CWE-79
Which versions are affected by CVE-2025-59417?
2 open source packages ship an affected version, including @lobehub/chat. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@lobehub/chat npm | All versions | 1.129.4 |
@lobehub/chat npm | All versions | 1.129.4 |
Products include Lobehub Lobe Chat.
How do I fix CVE-2025-59417?
Upgrade @lobehub/chat to 1.129.4 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-59417 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59417 exists.
Other vulnerabilities in lobehub lobe-chat
- CVE-2024-47066 Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)
- CVE-2024-32964 lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability
- CVE-2024-32965 ssrf vulnerability in lobe-chat
- CVE-2024-37895 API Key Leak in lobe-chat
- CVE-2024-24566 Lobe Chat unauthorized access to plugins
Sources
Also known as GHSA-m79r-r765-5f9j.