https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 21 Oct 2026 15:09:12 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-244987 EUVD-2026-244987 https://cve.radiocsirt.org/vuln/euvd-2026-244987 https://cve.radiocsirt.org/vuln/fkie_cve-2024-24566 <p>Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4.</p> <p>Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). This vulnerability is patched in 0.122.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-24566 https://cve.radiocsirt.org/vuln/ghsa-pf55-fj96-xf37 <p><strong>Affected:</strong> npm: @lobehub/chat</p> <p>### Description: When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). ### Proof-of-Concept: Let’s suppose that application has been deployed with following command: ```sudo docker run -d -p 3210:3210 -e OPENAI_API_KEY=sk-[REDACTED] -e ACCESS_CODE=TEST123 --name lobe-chat lobehub/lobe-chat``` Due to the utilization of the `ACCESS_CODE`, access to the chat is possible only after entering the password: </p> <p>However, it is possible to interact with chat plugins without entering the `ACCESS_CODE`. Example HTTP request: ``` POST /api/plugin/gateway HTTP/1.1 Host: localhost:3210 Content-Length: 1276</p> <p>{&#34;apiName&#34;:&#34;checkWeatherUsingGET&#34;,&#34;arguments&#34;:&#34;{\n \&#34;location\&#34;: \&#34;London\&#34;\n}&#34;,&#34;identifier&#34;:&#34;WeatherGPT&#34;,&#34;type&#34;:&#34;default&#34;,&#34;manifest&#34;:{&#34;api&#34;:[{&#34;description&#34;:&#34;Get current weather information&#34;,&#34;name&#34;:&#34;checkWeatherUsingGET&#34;,&#34;parameters&#34;:{&#34;properties&#34;:{&#34;location&#34;:{&#34;type&#34;:&#34;string&#34;}},&#34;required&#34;:[&#34;location&#34;],&#34;type&#34;:&#34;object&#34;}}],&#34;homepage&#34;:&#34;https://weathergpt.vercel.app/legal&#34;,&#34;identifier&#34;:&#34;WeatherGPT&#34;,&#34;meta&#34;:{&#34;avatar&#34;:&#34;https://openai-collections.chat-plugin.lobehub.com/weather-gpt/logo.webp&#34;,&#34;description&#34;:&#34;Get current weather information for a specific location.&#34;,&#34;title&#34;:&#34;WeatherGPT&#34;},&#34;openapi&#34;:&#34;https://openai-collections.chat-plugin.lobehub.com/weather-gpt/openapi.json&#34;,&#34;systemRole&#34;:&#34;Use the We…</p> <p><strong>Affected:</strong> npm: @lobehub/chat</p> <p>### Description: When the application is password-protected (deployed with the `ACCESS_CODE` option), it is possible to access plugins without proper authorization (without password). ### Proof-of-Concept: Let’s suppose that application has been deployed with following command: ```sudo docker run -d -p 3210:3210 -e OPENAI_API_KEY=sk-[REDACTED] -e ACCESS_CODE=TEST123 --name lobe-chat lobehub/lobe-chat``` Due to the utilization of the `ACCESS_CODE`, access to the chat is possible only after entering the password: </p> <p>However, it is possible to interact with chat plugins without entering the `ACCESS_CODE`. Example HTTP request: ``` POST /api/plugin/gateway HTTP/1.1 Host: localhost:3210 Content-Length: 1276</p> <p>{&#34;apiName&#34;:&#34;checkWeatherUsingGET&#34;,&#34;arguments&#34;:&#34;{\n \&#34;location\&#34;: \&#34;London\&#34;\n}&#34;,&#34;identifier&#34;:&#34;WeatherGPT&#34;,&#34;type&#34;:&#34;default&#34;,&#34;manifest&#34;:{&#34;api&#34;:[{&#34;description&#34;:&#34;Get current weather information&#34;,&#34;name&#34;:&#34;checkWeatherUsingGET&#34;,&#34;parameters&#34;:{&#34;properties&#34;:{&#34;location&#34;:{&#34;type&#34;:&#34;string&#34;}},&#34;required&#34;:[&#34;location&#34;],&#34;type&#34;:&#34;object&#34;}}],&#34;homepage&#34;:&#34;https://weathergpt.vercel.app/legal&#34;,&#34;identifier&#34;:&#34;WeatherGPT&#34;,&#34;meta&#34;:{&#34;avatar&#34;:&#34;https://openai-collections.chat-plugin.lobehub.com/weather-gpt/logo.webp&#34;,&#34;description&#34;:&#34;Get current weather information for a specific location.&#34;,&#34;title&#34;:&#34;WeatherGPT&#34;},&#34;openapi&#34;:&#34;https://openai-collections.chat-plugin.lobehub.com/weather-gpt/openapi.json&#34;,&#34;systemRole&#34;:&#34;Use the We…</p> https://cve.radiocsirt.org/vuln/ghsa-pf55-fj96-xf37 https://cve.radiocsirt.org/vuln/gsd-2024-24566 gsd-2024-24566 https://cve.radiocsirt.org/vuln/gsd-2024-24566