CVE-2026-72594: LobeHub Lobe-Chat Stored XSS Vulnerability

CVE-2026-72594 Overview

CVE-2026-72594 is a stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through version v2.2.13. A low-privileged authenticated user can inject arbitrary JavaScript into the application by uploading a crafted Scalable Vector Graphics (SVG) file as a user avatar. When another user renders the avatar, the embedded script executes in their browser context. The flaw is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can execute JavaScript in victim browsers, hijack sessions, and pivot to other accounts through a persistently stored avatar payload.

Affected Products

lobehub/lobe-chat through v2.2.13
Self-hosted lobe-chat deployments serving user-uploaded avatars
Multi-tenant lobe-chat instances with open registration

Discovery Timeline

2026-08-10 - CVE-2026-72594 published to the National Vulnerability Database (NVD)
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72594

Vulnerability Analysis

The vulnerability resides in the avatar upload handler of lobe-chat. The application accepts SVG files as valid image inputs for user profile avatars. SVG is an XML-based format that natively supports embedded JavaScript through <script> elements and event handler attributes such as onload or onclick.

When a victim views a page rendering the malicious avatar, the browser parses the SVG inline and executes the embedded script. Because the payload is persisted server-side, every user who loads the attacker's profile triggers execution. The scope change indicates that script execution affects components beyond the initial vulnerable resource.

Exploitation requires only a low-privileged authenticated account and minimal user interaction. Successful attacks can lead to session token theft, account takeover, credential harvesting through injected forms, and unauthorized actions performed against the lobe-chat API on behalf of the victim.

Root Cause

The root cause is the absence of server-side sanitization and content-type restriction on avatar uploads. The application does not strip active content from SVG files, does not convert uploads to a safe raster format, and does not serve user-generated files with a restrictive Content-Security-Policy or Content-Disposition: attachment header. See the GitHub Lobe Chat Repository for source references.

Attack Vector

The attacker registers or authenticates to a lobe-chat instance, then submits a crafted SVG file through the avatar upload endpoint. The SVG contains a <script> tag or an SVG event handler carrying the JavaScript payload. The server stores the file and returns a URL. When any user visits a chat, mention, or profile view that inlines the SVG, the payload executes in the victim's origin.

Because no verified public exploit code is available, refer to the vendor repository for technical details on the upload endpoint and rendering paths.

Detection Methods for CVE-2026-72594

Indicators of Compromise

Avatar files with Content-Type: image/svg+xml stored in the user uploads directory containing <script>, onload=, or javascript: tokens
Outbound HTTP requests from authenticated user sessions to unfamiliar domains immediately after loading a profile view
Unexpected API calls originating from a browser session shortly after rendering another user's avatar

Detection Strategies

Scan the avatar storage bucket or directory for SVG files containing script tags, event handler attributes, or xlink:href values beginning with javascript:
Inspect web server access logs for SVG avatar requests followed by anomalous authenticated API activity from the same session
Deploy Content Security Policy violation reporting to surface inline script execution originating from user-controlled assets

Monitoring Recommendations

Alert on any new SVG upload to the avatar endpoint and quarantine pending review
Monitor authentication events for session reuse from multiple IP addresses following avatar interactions
Track browser console errors and CSP reports centrally to detect XSS attempts against staff and administrator accounts

How to Mitigate CVE-2026-72594

Immediate Actions Required

Restrict avatar uploads to raster formats such as PNG, JPEG, and WEBP; reject SVG at the upload handler
Audit existing avatars and remove any SVG files or files whose content does not match their declared MIME type
Force a password reset and session invalidation for administrator accounts that may have viewed untrusted profiles

Patch Information

At the time of publication, the NVD entry does not reference a fixed release. Monitor the GitHub Lobe Chat Repository for a version above v2.2.13 that addresses the SVG avatar handling. Apply the update to all self-hosted deployments once available.

Workarounds

Serve all user-uploaded content from a separate sandbox domain with a strict Content-Security-Policy blocking inline scripts
Set Content-Disposition: attachment on avatar responses to prevent inline rendering in the browser
Sanitize SVG uploads server-side using a library such as DOMPurify in SVG mode, or transcode SVG to PNG before storage

bash

# Nginx configuration example: force download and restrict scripts for user uploads
location /uploads/avatars/ {
    add_header Content-Disposition "attachment" always;
    add_header Content-Security-Policy "default-src 'none'; script-src 'none'; sandbox;" always;
    add_header X-Content-Type-Options "nosniff" always;
    types { image/png png; image/jpeg jpg jpeg; image/webp webp; }
    default_type application/octet-stream;
}