CVE-2026-58578
MEDIUM SEVERITYCVSS Score & Metrics
Base Score
6.5 / 10
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability Description
LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craft a malicious basePath value containing unescaped regex metacharacters such as catastrophic-backtracking patterns, which are injected into a dynamically constructed regular expression in the findSkillMd function and executed synchronously against archive entries, denying service to all concurrent users for tens of seconds per request.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-1333
Source
NVD
Vendor
lobehub
Product
lobehub
External References
- https://github.com/lobehub/lobehub/commit/349bbe326eb8635d6d9c6a96d12702681ae3a84a
- https://github.com/lobehub/lobehub/issues/16494
- https://github.com/lobehub/lobehub/pull/16548
- https://github.com/lobehub/lobehub/releases/tag/v2.2.10-canary.15
- https://www.vulncheck.com/advisories/lobechat-canary-15-regular-expression-denial-of-service-in-github-skill-import
Discussion (0)
Add Comment
No comments yet. Be the first!