This vulnerability involves improper neutralization of input during web page generation (CWE-79) in lobehub's lobe-chat through version 2.2.13. An authenticated user with low privileges can exploit this by uploading a maliciously crafted SVG file as their avatar, resulting in stored cross-site scripting. The vulnerability has a CVSS 3.1 base score of 7.6, indicating high severity with network attack vector, low attack complexity, required privileges, and user interaction. The impact includes high confidentiality loss, limited integrity loss, and no availability impact. The product is cloud-hosted, and no vendor advisory or patch information is currently available.

An attacker with low privileges can inject arbitrary JavaScript code into the application via a crafted SVG avatar upload. This can lead to high confidentiality impact, potentially exposing sensitive information. Integrity impact is limited, and availability is not affected. Since the product is cloud-hosted, the vendor typically manages remediation server-side, but no confirmation of patch or mitigation is currently provided.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a cloud service, the vendor likely manages remediation on their side. Until official guidance or patch is available, restrict avatar uploads to trusted users if possible and monitor for suspicious activity related to SVG uploads.