Executive brief
Lobe Chat Desktop is a popular AI chat application that allows users to interact with multiple AI models through a desktop interface. A cross-site scripting vulnerability in how the application renders SVG chat artifacts can be exploited by attackers to execute arbitrary code on a user's computer by injecting malicious chat messages. This could allow complete compromise of the user's system through prompt injection, compromised AI server integrations, or tool exploits.
Technical details
Lobe Chat Desktop contains a cross-site scripting (XSS) vulnerability in its SVG artifact rendering component, which uses dangerouslySetInnerHTML to render user-supplied SVG content without proper sanitization. An attacker can inject a lobeArtifact element with type="image/svg+xml" containing malicious JavaScript (e.g., via onerror events in SVG img tags) into chat messages through prompt injection, compromised MCP servers, or tool integrations. Once XSS is achieved in the Electron renderer process, the attacker can invoke privileged IPC APIs (specifically openExternalLink) that lack input validation, allowing arbitrary command execution via file:// URIs or shell commands. The vulnerability affects versions up to 1.129.3 and is fixed in 1.129.4.
Affected products
- Lobe Chat Desktop up to 1.129.3
Timeline
- 2025-09-18: disclosed
- 2025-09-18: patched: fixed in version 1.129.4