Threats tagged 'ghsa-cjxw-hmxq-h489'

A stored cross-site scripting (XSS) vulnerability exists in lobehub/lobe-chat through version 2.2.13. This flaw allows a low-privileged authenticated user to inject arbitrary JavaScript code by uploading a crafted SVG file as a user avatar. The vulnerability can lead to high confidentiality impact with limited integrity impact and no availability impact.