CVE-2025-62505

LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery SSRF in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array together with impls containing the value naive. The service...

CVE-2025-62505

LobeChat exposes an SSRF in version 1.136.1 via the web-crawler’s tools.search.crawlPages endpoint. The naive impl (naive) allows a user-provided urls array to be fetched server-side without validating internal network addresses (localhost, 127.0.0.1, private ranges, or metadata endpoints). With ...

EUVD-2025-34905

Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module...

Lobe Chat 代码问题漏洞

Lobe Chat is an open source, high performance chatbot framework open sourced from LobeHub. A code issue vulnerability exists in Lobe Chat version 1.136.1, which stems from tools.search.crawlPages tRPC endpoints that do not validate or restrict internal network addresses, which could lead to a...