Dashboard / CVE-2026-58578

CVE-2026-58578

MEDIUM
MEDIUM Priority: 0.04 BB Relevance: 63/100
Published: 2026-07-02 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: None
I: None
A: High

Description

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability that allows authenticated attackers to block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. Attackers can craft a malicious basePath value containing unescaped regex metacharacters such as catastrophic-backtracking patterns, which are injected into a dynamically constructed regular expression in the findSkillMd function and executed synchronously against archive entries, denying service to all concurrent users for tens of seconds per request.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
lobehub lobehub 0 < 2.2.10-canary.15

References & Advisories (5)

https://github.com/lobehub/lobehub/issues/16494
exploit technical-description issue-tracking

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS — Exploitation Probability

0.55%
Raw Score 0.005480
Percentile 46.5%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00548
2026-11-12
0.00548
2026-11-10
0.00548
2026-11-09
0.00548
2026-11-08
0.00548

Intelligence Sources

mitre ref →

External Links