CVE-2024-47066

Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.19.13, server-side request forgery protection implemented in `src/app/api/proxy/route.ts` does not consider redirect and could be bypassed when attacker provides an external malicious URL which redirects to internal resources like a private network or loopback address. Version 1.19.13 contains an improved fix for the issue.

• CWE-918

• https://github.com/lobehub/lobe-chat/blob/main/src/app/api/proxy/route.tsBroken Link
• https://github.com/lobehub/lobe-chat/commit/e960a23b0c69a5762eb27d776d33dac443058fafPatch
• https://github.com/lobehub/lobe-chat/security/advisories/GHSA-3fc8-2r3f-8wrgExploit, Third Party Advisory
• https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphcNot Applicable

Published

Sep 23, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-47060Zitadel is an open source identity management platform. In Z…6.5
• CVE-2024-47061Plate is a javascript toolkit that makes it easier for you t…8.3
• CVE-2024-47062Navidrome is an open source web-based music collection serve…8.8
• CVE-2024-47063Computer Vision Annotation Tool (CVAT) is an interactive vid…6.1
• CVE-2024-47064Computer Vision Annotation Tool (CVAT) is an interactive vid…6.1
• CVE-2024-47065Meshtastic is an open source mesh networking solution. Prior…6.5
• CVE-2024-47067AList is a file list program that supports multiple storages…6.1
• CVE-2024-47068Rollup is a module bundler for JavaScript. Versions prior to…6.1
• CVE-2024-47069Oveleon Cookie Bar is a cookie bar is for the Contao Open So…6.1
• CVE-2024-4707The Materialis Companion plugin for WordPress is vulnerable …5.4
• CVE-2024-47070authentik is an open-source identity provider. A vulnerabili…9
• CVE-2024-47071OSS Endpoint Manager is an endpoint manager module for FreeP…6.8