LobeChat, a Node.js application, contains a regular‑expression denial‑of‑service flaw before version 2.2.10‑canary.15. An authenticated user can craft a GitHub repository URL path that includes a catastrophic‑backtracking regex pattern. The application interpolates the unvalidated basePath into a dynamically constructed regular input triggers excessive backtracking, the for tens of seconds, temporarily denying service to all concurrent users.

The affected product is LobeChat from lobehub. All releases prior to 2.2.10‑canary.15 are vulnerable. The vulnerability is triggered during the skill import process when a GitHub repository URL is supplied with a malicious basePath.

The CVSS score of 7.1 classifies the issue as high severity, while the EPSS score of <1% indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker must be authenticated to LobeChat and perform a skill import, then supply a malicious GitHub repository path containing a catastrophic‑backtracking pattern. The exploit causes the server to execute a long, CPU‑bound regex match, halting the event loop and affecting all active sessions. While the description does not explicitly state that the attack can be repeated to maintain denial of service, based on the nature of the flaw it is inferred that multiple imports could be performed to sustain the impact.