Vulnerability Description
LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craft a malicious basePath value containing unescaped regex metacharacters such as catastrophic-backtracking patterns, which are injected into a dynamically constructed regular expression in the findSkillMd function and executed synchronously against archive entries, denying service to all concurrent users for tens of seconds per request.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/lobehub/lobehub/commit/349bbe326eb8635d6d9c6a96d12702681ae3a8
- https://github.com/lobehub/lobehub/issues/16494
- https://github.com/lobehub/lobehub/pull/16548
- https://github.com/lobehub/lobehub/releases/tag/v2.2.10-canary.15
- https://www.vulncheck.com/advisories/lobechat-canary-15-regular-expression-denia
FAQ
What is CVE-2026-58578?
CVE-2026-58578 is a vulnerability with a CVSS score of 6.5 (MEDIUM). LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catast...
How severe is CVE-2026-58578?
CVE-2026-58578 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-58578?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.