CyberRota Analysis
AI-GeneratedA stored cross-site scripting vulnerability in the LobeHub chat application allows low-privileged authenticated users to upload malicious SVG files as avatars, leading to arbitrary JavaScript execution in the browsers of users who view the attacker's profile. This poses a significant risk as it can facilitate session hijacking, data theft, or further exploitation of users. Organizations using affected versions of LobeHub should prioritize patching this vulnerability to protect their users from potential attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar.