LobeHub’s content renderer falls back to an HTML renderer when a custom tag type is not matched, allowing malicious tags to be injected via a no‑match path. An attacker can cause the large‐language model component to output content containing such tags, delivering a client‑side XSS payload. From that XSS context the attacker can access the exposed Electron IPC gateway, runCommand, which accepts an unrestricted command string and executes it under the current user’s privileges. The combination of the XSS vector with the unfiltered command interface provides a direct path to arbitrary system command execution.

All releases of LobeHub before version 2.1.48 are susceptible. The vulnerability is mitigated in 2.1.48 and later. Coordination with the vendor is required to confirm the exact build and update chain for affected installations.

The CVSS score of 6.2 indicates a medium severity, but the presence of a local IPC command interface and the possibility for an attacker to coerce a user’s browser into executing XSS elevates the risk to higher than typical XSS. With no EPSS data available, the likelihood can only be inferred; however, because the exploit chain requires user interaction to trigger XSS, the attack vector is likely “User Interaction.” The vendor has not listed this issue in the CISA KEV catalog, which suggests no known widespread exploitation yet, but the potential for local privilege escalation remains high.