CVE-2026-58578
MEDIUMCVSS v3.1: 6.5
Source data as of:
At a glance
- Severity
- MEDIUM
- CVSS
- 6.5 v3.1 · NVD
- EPSS
- EPSS not provided by FIRST.org for this CVE
- CISA KEV
- No
- Attack conditions (CVSS vector)
- NetworkNo user interaction · Source: NVD Vector
- Published
- 2026-07-02 · Modified: 2026-07-02
- References
- Jump to references (5)
CVSS / EPSS / KEV
Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources
Description
LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craft a malicious basePath value containing unescaped regex metacharacters such as catastrophic-backtracking patterns, which are injected into a dynamically constructed regular expression in the findSkillMd function and executed synchronously against archive entries, denying service to all concurrent users for tens of seconds per request.
References
Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.
- Patch https://github.com/lobehub/lobehub/commit/349bbe326eb8635d6d9c6a96d12702681ae3a84a
- Reference https://github.com/lobehub/lobehub/issues/16494
- Reference https://github.com/lobehub/lobehub/pull/16548
- Patch https://github.com/lobehub/lobehub/releases/tag/v2.2.10-canary.15
- Vendor advisory https://www.vulncheck.com/advisories/lobechat-canary-15-regular-expression-denial-of-servi…