The vulnerability in LobeChat prior to version 2.2.10-canary.15 arises from unsafe handling of user-supplied basePath values containing unescaped regex metacharacters. These values are injected into a dynamically constructed regular expression within the findSkillMd function and executed synchronously against archive entries. This leads to catastrophic backtracking, causing the Node.js event loop to block and resulting in a denial of service condition affecting all concurrent users. Exploitation requires authentication and involves crafting a malicious GitHub repository URL path during skill import.

An authenticated attacker can cause a denial of service by blocking the Node.js event loop for tens of seconds per request, effectively disrupting service availability for all users during the attack window.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid importing skills from untrusted GitHub repository URLs or restrict authenticated user input to prevent injection of unescaped regex metacharacters in the basePath parameter.