Detections
Analytics

SCA: security update for @lobehub/chat (GHSA-m79r-r765-5f9j)

high Tenable Self-Hosted Container Security Plugin ID 435372

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.129.4, there is a a
 cross-site scripting (XSS) vulnerability when handling chat message in lobe-chat that can be escalated to
 remote code execution on the user’s machine. In lobe-chat, when the response from the server is like
 <lobeArtifact identifier="ai-new-interpretation" ...> , it will be rendered with the lobeArtifact node,
 instead of the plain text. However, when the type of the lobeArtifact is image/svg+xml , it will be
 rendered as the SVGRender component, which internally uses dangerouslySetInnerHTML to set the content of
 the svg, resulting in XSS attack. Any party capable of injecting content into chat messages, such as
 hosting a malicious page for prompt injection, operating a compromised MCP server, or leveraging tool
 integrations, can exploit this vulnerability. This vulnerability is fixed in 1.129.4. (CVE-2025-59417)

See Also

https://github.com/advisories/GHSA-m79r-r765-5f9j

Plugin Details

Severity: High

ID: 435372

Version: Revision 1.11

Type: Local

Family: SCA Checks

Published: 9/19/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 9.14

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2025-59417

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.7

Threat Score: 6.8

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/18/2025

Vulnerability Publication Date: 9/18/2025

Reference Information

CVE: CVE-2025-59417

cwe: CWE-79