A stored cross-site scripting vulnerability in Lobe-Chat allows authenticated attackers to execute arbitrary scripts in the context of other users.

This is a stored cross-site scripting (XSS) flaw, classified under CWE-79, which occurs due to improper neutralization of user-supplied input. The attack requires the attacker to possess low-level privileges to store the malicious payload within the application.

Successful exploitation of this vulnerability could lead to session hijacking, unauthorized actions performed on behalf of users, or the theft of sensitive information stored within the chat interface. With a CVSS score of 7.6, the vulnerability represents a significant risk to application integrity and user confidentiality, particularly in collaborative environments.

Immediate Action: Upgrade to a version beyond 2.2.13 as soon as the vendor provides a patched release.

Proactive Monitoring: Review application logs for suspicious script tags or encoded characters being submitted via chat inputs.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts within the browser.

Public Exploit Available: Unknown.

Given the high severity of this XSS vulnerability, administrators should prioritize updating the Lobe-Chat instance to the latest secure version. Until an update is applied, ensure that strict input validation and output encoding practices are enforced at the application level to mitigate the risk of script execution.