CVE-2025-62505: Lobe Chat server-side request forgery in web crawler

CVE-2025-62505 · Severity: low · CVSS 3.1 · Published 2025-10-17

Lobe Chat is an AI chat application with a built-in web crawling feature that allows the server to fetch and process content from URLs. A flaw in the web crawler fails to validate or restrict outbound HTTP requests, allowing authenticated attackers to make the server request internal resources like localhost APIs, private networks, and cloud metadata endpoints. This could lead to unauthorized access to internal system information, leaked credentials, and lateral movement within a network.

Technologies: LobeHub Lobe Chat, @lobehub/chat (npm). Vendors: LobeHub, npm.

Quick answers

Is CVE-2025-62505 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-62505 being exploited in the wild.
How severe is CVE-2025-62505?
Low severity, with a CVSS score of 3.1, published 17 October 2025.
Which products and versions are affected?
LobeHub Lobe Chat <= 1.136.1; @lobehub/chat (npm) SEMVER:introduced=0,fixed=1.136.2.
Is there a fix for CVE-2025-62505?
Yes. @lobehub/chat (npm): upgrade to 1.136.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-62505 attacked?
It is attacked over the network.
Am I affected by CVE-2025-62505?
Check whether you run LobeHub Lobe Chat or @lobehub/chat (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @lobehub/chat (npm): upgrade to 1.136.2 or later
    npm install @lobehub/chat@1.136.2

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) in the tRPC endpoint tools.search.crawlPages. When a client supplies an array of URLs and specifies the "naive" implementation, the server performs unfiltered HTTP requests to those URLs without validating against private IP ranges (127.0.0.1, localhost, 10.0.0.0/8, etc.) or cloud metadata endpoints (169.254.169.254). The vulnerable code path flows through the tRPC router → Crawler.crawl → naive implementation's fetch(url), which executes the request as-is. While production deployments require valid authentication tokens, the vulnerability can be exploited in dev environments by bypassing auth via the lobe-auth-dev-backend-api header. An attacker can retrieve responses from internal APIs and metadata servers, potentially exposing credentials, configuration, and system state. The fix is available in version 1.136.2 and later.

Affected products

  • LobeHub Lobe Chat <= 1.136.1

Identifiers

  • CVE-2025-62505
  • GHSA-fgx4-p8xf-qhp9

Timeline

  • 2025-10-17: disclosed
  • 2025-10-17: patched: Fixed in version 1.136.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.