pypi package report

Is @lobehub/chat safe?

1 known vulnerability, worst severity CRITICAL.

cvss

9.0

how bad it is if exploited, out of 10

epss

53.0%

chance of exploitation in the next 30 days

xyz score

5.8

CyberXYZ composite, out of 10

fig. 01 — GHSA-mxhq-xw3g-rphc, the advisory selected below

// advisories

GHSA-mxhq-xw3g-rphc

CRITICALCVE-2024-32964

SSRF protection implemented in https://github.com/lobehub/lobe-chat/blob/main/src/app/api/proxy/route.ts does not consider redirect and could be bypassed when attacker provides external malicious url which redirects to internal resources like private network or loopback address.

Affected: >=0, <1.19.13
Fixed in: 0.150.6
Weakness: CWE-918
Published: 2024-05-10
Source: github

GHSA NVD MITRE

// dependencies

0 direct

// ai model usage

No published models are known to use this package.

Checked 2026-09-22 at 02:45 UTC. The most recent advisory here was published 2024-05-10. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Is @lobehub/chat safe? pypi package security report | CyberXYZ