Executive brief
Lobe Chat, an AI agent management and chat application, contains a stored cross-site scripting vulnerability in its Mermaid diagram rendering component. An attacker can inject malicious code through chat artifacts that, when rendered, execute arbitrary JavaScript and can escalate to remote code execution on users' systems. This allows complete compromise of user data, application functionality, and potentially the underlying system.
Technical details
The vulnerability is a stored XSS in the Renderer component that processes Mermaid diagram artifacts. The vulnerable code passes the `content` variable (derived from user or AI messages) directly to the `<Mermaid>` component without sanitization. The Mermaid library renders HTML labels in node definitions (e.g., `["..."]`) directly into the DOM; if this content contains malicious HTML tags such as `<img onerror=...>`, they are executed with the application's privileges. The provided PoC demonstrates fetching external endpoints that can install additional payloads. Attack vector is network-based with low complexity, requiring only user interaction (viewing a malicious chat artifact). The vulnerability affects all versions up to and including v2.0.0-next.179; patch available in v2.0.0-next.180.
Affected products
- LobeHub Lobe Chat <= v2.0.0-next.179
Timeline
- 2026-01-17: disclosed: Advisory GHSA-4gpc-rhpj-9443 published
- 2026-01-20: patched: Patch released in v2.0.0-next.180