Home

Description

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craft a malicious basePath value containing unescaped regex metacharacters such as catastrophic-backtracking patterns, which are injected into a dynamically constructed regular expression in the findSkillMd function and executed synchronously against archive entries, denying service to all concurrent users for tens of seconds per request.

PUBLISHED Reserved 2026-07-01 | Published 2026-07-02 | Updated 2026-07-14 | Assigner VulnCheck




MEDIUM: 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

HIGH: 7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Problem types

Inefficient Regular Expression Complexity

Product status

Default status
affected

Any version before 2.2.10-canary.15
affected

Credits

George Chen finder

References

github.com/lobehub/lobehub/releases/tag/v2.2.10-canary.15 (Release Notes) release-notes

github.com/lobehub/lobehub/issues/16494 (Researcher Disclosure) exploit technical-description

github.com/lobehub/lobehub/pull/16548 (Fix PR) issue-tracking

github.com/...ommit/349bbe326eb8635d6d9c6a96d12702681ae3a84a (Fix Commit) patch

www.vulncheck.com/...enial-of-service-in-github-skill-import third-party-advisory

cve.org (CVE-2026-58578)

nvd.nist.gov (CVE-2026-58578)

Download JSON