CVE-2026-23733: Lobe Chat stored XSS in Mermaid artifact renderer escalating to RCE

CVE-2026-23733 · Severity: low · CVSS 3.1 · Published 2026-01-20

Lobe Chat, an AI agent management and chat application, contains a stored cross-site scripting vulnerability in its Mermaid diagram rendering component. An attacker can inject malicious code through chat artifacts that, when rendered, execute arbitrary JavaScript and can escalate to remote code execution on users' systems. This allows complete compromise of user data, application functionality, and potentially the underlying system.

Technologies: LobeHub Lobe Chat, @lobehub/chat (npm). Vendors: LobeHub, npm.

Quick answers

Is CVE-2026-23733 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-23733 being exploited in the wild.
How severe is CVE-2026-23733?
Low severity, with a CVSS score of 3.1, published 20 January 2026.
Which products and versions are affected?
LobeHub Lobe Chat <= v2.0.0-next.179; @lobehub/chat (npm) SEMVER:introduced=0,last_affected=1.143.2.
Is there a fix for CVE-2026-23733?
A patch was published on 2026-01-20: Patch released in v2.0.0-next.180 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23733 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-23733?
Check whether you run LobeHub Lobe Chat or @lobehub/chat (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored XSS in the Renderer component that processes Mermaid diagram artifacts. The vulnerable code passes the `content` variable (derived from user or AI messages) directly to the `<Mermaid>` component without sanitization. The Mermaid library renders HTML labels in node definitions (e.g., `["..."]`) directly into the DOM; if this content contains malicious HTML tags such as `<img onerror=...>`, they are executed with the application's privileges. The provided PoC demonstrates fetching external endpoints that can install additional payloads. Attack vector is network-based with low complexity, requiring only user interaction (viewing a malicious chat artifact). The vulnerability affects all versions up to and including v2.0.0-next.179; patch available in v2.0.0-next.180.

Affected products

  • LobeHub Lobe Chat <= v2.0.0-next.179

Identifiers

  • CVE-2026-23733
  • GHSA-4gpc-rhpj-9443

Timeline

  • 2026-01-17: disclosed: Advisory GHSA-4gpc-rhpj-9443 published
  • 2026-01-20: patched: Patch released in v2.0.0-next.180

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.