CVE-2024-32964: Lobehub Lobe Chat

Critical severity, CVSS 9.0. EPSS: 53% chance of exploitation in the next 30 days.

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.

Affected products

• Lobehub Lobe Chat: before 0.150.6 (fixed in 0.150.6)

Published 2024-05-14. Last modified 2026-06-17.