CVE-2025-59417: Lobehub Lobe Chat XSS Vulnerability

CVE-2025-59417 Overview

CVE-2025-59417 is a cross-site scripting (XSS) vulnerability in Lobe Chat, an open-source artificial intelligence chat framework maintained by Lobehub. The flaw affects all versions prior to 1.129.4. When the server response contains a <lobeArtifact> element with the type image/svg+xml, Lobe Chat renders the content through the SVGRender component, which uses dangerouslySetInnerHTML without sanitization. Attackers who can inject content into chat messages, through malicious pages used for prompt injection, compromised Model Context Protocol (MCP) servers, or tool integrations, can execute arbitrary JavaScript in the victim's browser and escalate to remote code execution on the user's machine. The issue is tracked under [CWE-79].

Critical Impact
Successful exploitation allows attackers to run arbitrary JavaScript inside the Lobe Chat client and escalate to remote code execution on the victim's workstation.

Affected Products

Lobehub Lobe Chat versions prior to 1.129.4
Deployments consuming untrusted MCP servers or third-party tool integrations
Self-hosted and container-based Lobe Chat installations exposed to external chat sources

Discovery Timeline

2025-09-18 - CVE-2025-59417 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-59417

Vulnerability Analysis

Lobe Chat parses assistant responses that contain custom <lobeArtifact> tags and renders them as structured nodes rather than plain text. When the artifact type attribute is set to image/svg+xml, the framework hands the payload to the SVGRender component. That component injects the raw SVG string into the DOM using React's dangerouslySetInnerHTML, bypassing normal escaping.

SVG documents accept inline <script> tags and event handler attributes such as onload, onerror, and onclick. An attacker who controls the artifact body can embed JavaScript that runs in the authenticated origin of the Lobe Chat application. From there, the attacker can access chat sessions, exfiltrate API keys, and pivot to the host system through installed plugins or Electron-style desktop wrappers, resulting in remote code execution.

Root Cause

The root cause is missing output sanitization on server-influenced content before it reaches dangerouslySetInnerHTML. The SVGRender component trusted the artifact payload verbatim. Any attacker path that populates the chat stream, including prompt injection from browsed content, malicious MCP servers, or tool call outputs, becomes a script injection vector.

Attack Vector

Exploitation requires a user to interact with a chat response that contains a crafted lobeArtifact payload. Because large language model (LLM) responses commonly incorporate untrusted third-party context, the interaction requirement is trivial to satisfy through indirect prompt injection.

typescript

// Security patch: packages/utils/src/client/sanitize.ts
import DOMPurify from 'dompurify';

/**
 * Sanitizes SVG content to prevent XSS attacks while preserving safe SVG elements and attributes
 * @param content - The SVG content to sanitize
 * @returns Sanitized SVG content safe for rendering
 */
export const sanitizeSVGContent = (content: string): string => {
  return DOMPurify.sanitize(content, {
    FORBID_ATTR: [
      'onblur', 'onchange', 'onclick', 'onerror', 'onfocus',
      'onkeydown', 'onkeypress', 'onkeyup', 'onload',
      'onmousedown', 'onmouseout', 'onmouseover', 'onmouseup',
      'onreset', 'onselect', 'onsubmit', 'onunload',
    ],
    FORBID_TAGS: ['embed', 'link', 'object', 'script', 'style'],
    KEEP_CONTENT: false,
  });
};
// Source: https://github.com/lobehub/lobe-chat/commit/9f044edd07ce102fe9f4b2fb47c62191c36da05c

The patch introduces a sanitizeSVGContent helper backed by DOMPurify and applies it before rendering SVG artifacts. It removes script and style tags, embeds, objects, and all common inline event handler attributes.

Detection Methods for CVE-2025-59417

Indicators of Compromise

Chat message payloads containing <lobeArtifact tags with type="image/svg+xml" originating from external tool calls or MCP responses.
SVG artifact bodies that include <script>, onload=, onerror=, or other DOM event handler attributes.
Outbound network connections from browser sessions to attacker-controlled domains shortly after rendering an assistant response.

Detection Strategies

Inspect Lobe Chat server logs and MCP transport logs for artifact responses containing SVG payloads with executable attributes.
Deploy content security policy (CSP) violation reporting to capture inline script execution attempts inside the Lobe Chat origin.
Correlate LLM tool call outputs with client-side DOM mutations that introduce <script> nodes or inline event handlers.

Monitoring Recommendations

Track the deployed Lobe Chat version across environments and alert on hosts still running versions earlier than 1.129.4.
Monitor MCP server integrations for untrusted or newly added endpoints that can influence chat responses.
Log and review browser process activity on workstations running desktop builds of Lobe Chat for unexpected child processes.

How to Mitigate CVE-2025-59417

Immediate Actions Required

Upgrade all Lobe Chat instances to version 1.129.4 or later, which introduces the sanitizeSVGContent DOMPurify wrapper.
Audit configured MCP servers and third-party tools, removing any integrations from untrusted sources.
Rotate API keys, session tokens, and OAuth credentials stored in the Lobe Chat client if exploitation is suspected.

Patch Information

The fix is delivered in commit 9f044edd07ce102fe9f4b2fb47c62191c36da05c and documented in the GitHub Security Advisory GHSA-m79r-r765-5f9j. The patch adds a sanitization module and routes all SVG artifact rendering through DOMPurify with strict tag and attribute allowlists.

Workarounds

Disable rendering of lobeArtifact SVG content by restricting artifact types to non-SVG values at the application layer until patching is complete.
Apply a strict CSP that forbids inline scripts and blocks unsafe-inline for the Lobe Chat origin.
Restrict Lobe Chat access to trusted user populations and disable inbound MCP tool integrations from external providers.

bash

# Upgrade Lobe Chat to the patched release
npm install @lobehub/chat@1.129.4

# Docker deployments
docker pull lobehub/lobe-chat:1.129.4
docker stop lobe-chat && docker rm lobe-chat
docker run -d --name lobe-chat -p 3210:3210 lobehub/lobe-chat:1.129.4