CVE-2026-42045: LobeHub LobeChat XSS to RCE via Electron IPC interface

CVE-2026-42045 · Severity: medium · CVSS 6.2 · Published 2026-05-12

LobeChat is an open-source platform for interacting with AI agents and large language models. A vulnerability in how the application handles AI-generated content allows a malicious AI response to execute unauthorized code on a user's computer. If a user connects to a compromised or malicious AI provider, an attacker could take control of the user's system, potentially leading to data theft or full system compromise.

Technologies: LobeHub LobeChat, @lobehub/lobehub (npm). Vendors: LobeHub, npm.

Quick answers

Is CVE-2026-42045 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42045 being exploited in the wild.
How severe is CVE-2026-42045?
Medium severity, with a CVSS score of 6.2, published 12 May 2026.
Which products and versions are affected?
LobeHub LobeChat < 2.1.48, <= 2.1.26; @lobehub/lobehub (npm) <= 2.1.26, SEMVER:introduced=0,last_affected=2.1.26.
Is there a fix for CVE-2026-42045?
A patch was published on 2026-05-12: Fixed in version 2.1.48 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42045 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42045?
Check whether you run LobeHub LobeChat or @lobehub/lobehub (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

LobeChat (prior to v2.1.48) contains a stored Cross-Site Scripting (XSS) vulnerability in its message rendering logic. Specifically, in `src/features/Portal/Artifacts/Body/Renderer/index.tsx`, the application defaults to `HTMLRenderer` when a custom tag type is not matched, failing to properly sanitize the input. An attacker who controls an LLM API endpoint can return a malicious payload containing HTML tags (e.g., `<img src=x onerror=...>`). In the Electron desktop client, this XSS can be used to access the `window.parent.electronAPI` handle. By invoking the `runCommand` IPC method, which lacks parameter filtering, the attacker can execute arbitrary system commands with the privileges of the current user. Exploitation requires the victim to connect their client to a malicious LLM provider.

Affected products

  • LobeHub LobeChat < 2.1.48

Identifiers

  • CVE-2026-42045
  • GHSA-xq4x-622m-q8fq

Timeline

  • 2026-04-27: advisory: GitHub Security Advisory published
  • 2026-05-12: disclosed: CVE-2026-42045 published
  • 2026-05-12: patched: Fixed in version 2.1.48

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.