Detections
Analytics
SCA: security update for @lobehub/chat (GHSA-fgx4-p8xf-qhp9)
low Tenable Cloud Security Plugin ID 435670
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1
allows server-side request forgery (SSRF) in the tools.search.crawlPages tRPC endpoint. A client can
supply an arbitrary urls array together with impls containing the value naive. The service passes the user
URLs to Crawler.crawl and the naive implementation performs a server-side fetch of each supplied URL
without validating or restricting internal network addresses (such as localhost, 127.0.0.1, private IP
ranges, or cloud instance metadata endpoints). This allows an attacker with a valid user token (or in
development mode using a bypass header) to make the server disclose responses from internal HTTP services,
potentially exposing internal API data or cloud metadata credentials. Version 1.136.2 fixes the issue.
Update to version 1.136.2. No known workarounds exist. (CVE-2025-62505)
See Also
Plugin Details
Severity: Low
ID: 435670
Version: Revision 1.13
Type: Local
Family: SCA Checks
Published: 10/17/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 1.2
Percentile: 0.01
Vendor
Vendor Severity: Low
CVSS v2
Risk Factor: Low
Base Score: 1.7
Temporal Score: 1.3
Vector: CVSS2#AV:N/AC:H/Au:M/C:P/I:N/A:N
CVSS Score Source: CVE-2025-62505
CVSS v3
Risk Factor: Low
Base Score: 3
Temporal Score: 2.6
Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 10/17/2025
Vulnerability Publication Date: 10/17/2025
Reference Information
CVE: CVE-2025-62505
cwe: CWE-918