CVE-2026-54157
Published:June 23, 2026
Updated:June 29, 2026
LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication. An attacker can use this to make arbitrary outbound requests from LobeHub's infrastructure, leak Vercel deployment details, and inject cookies on the lobehub.com domain through reflected Set-Cookie headers. This vulnerability is fixed in 2.1.57.
Affected Packages
https://github.com/lobehub/lobehub.git (GITHUB):
Affected version(s) >=pr-build-6474-a1d7469db7a18b07d5f51951768df10d0c5bf838 <2.1.57Fix Suggestion:
Update to version 2.1.57@lobehub/lobehub (NPM):
Affected version(s) >=1.143.0-next.2 <2.1.57Fix Suggestion:
Update to version 2.1.57Related Resources (2)
Do you need more information?
Contact UsCVSS v4
Base Score:
8.5
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
HIGH
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
LOW
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
HIGH
Subsequent System Integrity
LOW
Subsequent System Availability
HIGH
CVSS v3
Base Score:
9
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
LOW
Availability
HIGH
Weakness Type (CWE)
Server-Side Request Forgery (SSRF)
EPSS
Base Score:
1.78