coxy (>=0.0.2, <=0.0.4), threed-garden (>=0.17.0-alpha.9, <=0.17.3-centauri.0) potentially affected by CVE-2026-42349 via @clerk/nextjs (>=6.3.1, <=6.28.1)

@clerk/nextjs NPM version =6.3.1, =0.0.2, =0.17.0-alpha.9, =0.17.3-centauri.0 Source cves: CVE-2026-42349 Source advisory: SNYK:JS-CLERKNEXTJS-16347747...

@clerk/elements (0.0.2-snapshot.vc65ad98), @spike-npm-land/code (0.9.55) potentially affected by CVE-2026-41248 via @clerk/nextjs (>=5.0.1-snapshot.vc65ad98, <=5.7.5)

@clerk/nextjs NPM version =5.0.1-snapshot.vc65ad98, =5.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on @clerk/nextjs and may be impacted: - @clerk/elements 0.0.2-snapshot.vc65ad98 - @spike-npm-land/code 0.9.55 Source cves: CVE-2026-41248 Source...

coxy (>=0.0.2, <=0.0.4), threed-garden (>=0.17.0-alpha.9, <=0.17.3-centauri.0) potentially affected by CVE-2026-41248 via @clerk/nextjs (>=6.3.1, <=6.28.1)

@clerk/nextjs NPM version =6.3.1, =0.0.2, =0.17.0-alpha.9, =0.17.3-centauri.0 Source cves: CVE-2026-41248 Source advisory: OSV:GHSA-VQX2-FGX2-5WQ9...

coxy (>=0.0.2, <=0.0.4), threed-garden (>=0.17.0-alpha.9, <=0.17.3-centauri.0) potentially affected by CVE-2026-41248 via @clerk/nextjs (>=6.3.1, <=6.28.1)

@clerk/nextjs NPM version =6.3.1, =0.0.2, =0.17.0-alpha.9, =0.17.3-centauri.0 Source cves: CVE-2026-41248 Source advisory: SNYK:JS-CLERKNEXTJS-16098250...

@clerk/elements (0.0.2-snapshot.vc65ad98), @spike-npm-land/code (0.9.55) potentially affected by CVE-2026-41248 via @clerk/nextjs (>=5.0.1-snapshot.vc65ad98, <=5.7.5)

@clerk/nextjs NPM version =5.0.1-snapshot.vc65ad98, =5.7.5 is affected by a known vulnerability. The following packages have a transitive dependency on @clerk/nextjs and may be impacted: - @clerk/elements 0.0.2-snapshot.vc65ad98 - @spike-npm-land/code 0.9.55 Source cves: CVE-2026-41248 Source...

Cross-site Scripting (XSS)

@lobehub/cha is vulnerable to a Cross-Site Scripting XSS. The vulnerability is due to unsafe SVG rendering due to SVGRenderer using dangerouslySetInnerHTML for image/svg+xml lobeArtifact content. An attacker can inject malicious SVGs via chat messages...

threed-garden (>=0.17.0-alpha.9, <=0.17.3-centauri.0) potentially affected by CVE-2025-53548 via @clerk/nextjs (>=6.3.1, <=6.17.0)

@clerk/nextjs NPM version =6.3.1, =0.17.0-alpha.9, =0.17.3-centauri.0 Source cves: CVE-2025-53548 Source advisory: OSV:GHSA-9MP4-77WG-RWX9...

GHSA-PF55-FJ96-XF37 @lobehub/chat vulnerable to unauthorized access to plugins

Description: When the application is password-protected deployed with the ACCESSCODE option, it is possible to access plugins without proper authorization without password. Proof-of-Concept: Let’s suppose that application has been deployed with following command: sudo docker run -d -p 3210:3210 -...