Regular Expression Denial of Service in LobeChat by LobeHub
CVE-2026-58578

7.1HIGH

Key Information:

Vendor

Lobehub

Status
Lobehub
Vendor
CVE Published:
2 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-58578?

The vulnerability in LobeChat enables authenticated attackers to exploit regular expression denial of service (ReDoS) by injecting catastrophic-backtracking patterns into a GitHub repository URL path during skill import. This flaw allows attackers to obstruct the Node.js event loop, leading to significant service disruption for concurrent users for extended periods. Attackers can utilize unescaped regex metacharacters in the basePath parameter, impacting the performance and availability of the application and imposing a risk to users relying on concurrent access.

Affected Version(s)

lobehub 0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-58578 - Proof of Concept

References

https://github.com/lobehub/lobehub/releases/tag/v2.2.10-c...
release-notes
https://github.com/lobehub/lobehub/issues/16494
exploittechnical-description
https://github.com/lobehub/lobehub/pull/16548
issue-tracking

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.