Executive brief
LobeChat is an open-source platform for interacting with AI agents and large language models. A vulnerability in how the application handles AI-generated content allows a malicious AI response to execute unauthorized code on a user's computer. If a user connects to a compromised or malicious AI provider, an attacker could take control of the user's system, potentially leading to data theft or full system compromise.
Technical details
LobeChat (prior to v2.1.48) contains a stored Cross-Site Scripting (XSS) vulnerability in its message rendering logic. Specifically, in `src/features/Portal/Artifacts/Body/Renderer/index.tsx`, the application defaults to `HTMLRenderer` when a custom tag type is not matched, failing to properly sanitize the input. An attacker who controls an LLM API endpoint can return a malicious payload containing HTML tags (e.g., `<img src=x onerror=...>`). In the Electron desktop client, this XSS can be used to access the `window.parent.electronAPI` handle. By invoking the `runCommand` IPC method, which lacks parameter filtering, the attacker can execute arbitrary system commands with the privileges of the current user. Exploitation requires the victim to connect their client to a malicious LLM provider.
Affected products
- LobeHub LobeChat < 2.1.48
Timeline
- 2026-04-27: advisory: GitHub Security Advisory published
- 2026-05-12: disclosed: CVE-2026-42045 published
- 2026-05-12: patched: Fixed in version 2.1.48