PT-2025-42638 · Lobe Chat · Lobe Chat

Published 2025-10-17 · Updated 2025-10-20 · CVE-2025-62505

Positive Technologies (AI Summary)

CVSS v3.1

3.0

Low

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions LobeChat versions prior to 1.136.2

Description LobeChat is susceptible to a server-side request forgery (SSRF) issue within the tools.search.crawlPages tRPC endpoint. An attacker can provide arbitrary URLs and specify the 'naive' implementation, causing the server to make unfiltered outbound HTTP requests to internal networks, localhost, or cloud metadata endpoints. This allows potential exposure of internal API data or cloud metadata credentials. The issue stems from the lack of validation or restriction of internal network addresses during server-side fetching. The vulnerable code is located in the naive.ts file. In a development environment, authentication can be bypassed using the 'lobe-auth-dev-backend-api: 1' header. The urls and impls parameters are used in the tRPC call to trigger the vulnerability.

Recommendations Update to LobeChat version 1.136.2 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-62505

GHSA-FGX4-P8XF-QHP9

Affected Products

Lobe Chat

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62505.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-62505 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62505 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fgx4-p8xf-qhp9 · Vendor Advisory
• https://github.com/lobehub/lobe-chat · Note
• https://github.com/lobehub/lobe-chat/blob/d942a635b36a231156c60d824afa573af8032572/packages/web-crawler/src/crawImpl/naive.ts#L39-L45 · Note
• https://github.com/lobehub/lobe-chat/security/advisories/GHSA-fgx4-p8xf-qhp9 · Note
• https://github.com/lobehub/lobe-chat/commit/8d59583dca16f218b99213d641733d8ba77f182c · Note
• https://reddit.com/r/VulnMatter/comments/1ob1a2r/resumen_diario_de_vulnerabilidades_19102025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1obkvoc/resumen_diario_de_vulnerabilidades_20102025 · Reddit Post
• https://t.me/CVEtracker/35214 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1979302363585237451 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1obi2if/resumen_diario_de_vulnerabilidades_20102025 · Reddit Post
• https://twitter.com/CVEnew/status/1979289022645067978 · Twitter Post