The vulnerability identified as CVE-2026-72594 is a stored XSS issue in lobehub/lobe-chat versions up to 2.2.13. An attacker with low privileges who is authenticated can exploit this by uploading a malicious SVG file as their avatar, which injects arbitrary JavaScript into the application. This can result in the compromise of user confidentiality and session data. The CVSS 3.1 base score is 7.6, reflecting network attack vector, low attack complexity, low privileges required, user interaction required, and scope change with high confidentiality impact, low integrity impact, and no availability impact. There are no known exploits in the wild and no patch or remediation information is currently provided.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the application, potentially leading to theft of sensitive information such as session tokens or user data (high confidentiality impact). Integrity impact is low, and availability is not affected. The attacker must be authenticated with low privileges and requires user interaction to trigger the payload.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or sanitize SVG file uploads for avatars and consider additional input validation or content security policies to mitigate XSS risks. Monitor vendor channels for updates.