PT-2026-55290 · Lobehub · Lobehub

George Chen · Publicado 2026-07-02 · Atualizado 2026-07-02 · CVE-2026-58578

Mitre

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craft a malicious basePath value containing unescaped regex metacharacters such as catastrophic-backtracking patterns, which are injected into a dynamically constructed regular expression in the findSkillMd function and executed synchronously against archive entries, denying service to all concurrent users for tens of seconds per request.

Exploit

Correção

DoS

Enumeração de Fraquezas

CWE-1333

Identificadores relacionados

CVE-2026-58578

Produtos afetados

Lobehub

Referências · 6

• 🔥 https://github.com/lobehub/lobehub/issues/16494 · Exploit
• https://github.com/lobehub/lobehub/commit/349bbe326eb8635d6d9c6a96d12702681ae3a84a · Correção
• https://github.com/lobehub/lobehub/pull/16548 · Nota
• https://github.com/lobehub/lobehub/releases/tag/v2.2.10-canary.15 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-58578 · Nota de Segurança
• https://vulncheck.com/advisories/lobechat-canary-15-regular-expression-denial-of-service-in-github-skill-import · Nota