high7.6
CVE-2026-72594
A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScrip…
Impact
A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar.
Affected products
| Product | Affected versions |
|---|---|
| Lobehub/Lobe-Chat | through 2.2.13 |
Versions were read from the advisory text. No structured product data has been published for this record yet.